🇷🇴
DamonOne
2026-09-22 00:33:57
(1 day ago)
Blocked by OPNsense; 12 hits, proto=tcp, ports=12992,17475,21752,37666
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-06-18 20:42:46
(3 months ago)
(mod_security) mod_security (id:210831) triggered by 120.229.152.211 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210831) triggered by 120.229.152.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 16:42:40.790006 2026] [security2:error] [pid 18591:tid 18591] [client 120.229.152.211:3609] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||agilesallc.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "agilesallc.net"] [uri "/"] [unique_id "ajRYQCBTeXOVcRGS1r_VagAAABM"], referer: https://agilesallc.net/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 03:31:11
(3 months ago)
(mod_security) mod_security (id:210831) triggered by 120.229.152.211 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210831) triggered by 120.229.152.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 23:31:04.683533 2026] [security2:error] [pid 26226:tid 26226] [client 120.229.152.211:3803] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||rlharmongroup.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "rlharmongroup.com"] [uri "/"] [unique_id "ajIU-E3L-oXVUI-jfrlWewAAABE"], referer: http://rlharmongroup.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 20:28:46
(3 months ago)
(mod_security) mod_security (id:210831) triggered by 120.229.152.211 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210831) triggered by 120.229.152.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 16:28:40.553147 2026] [security2:error] [pid 18764:tid 18764] [client 120.229.152.211:3648] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||neconebooks.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "neconebooks.com"] [uri "/"] [unique_id "ai29eC1iFkmOOjWuZ4nQ0AAAAEs"], referer: http://neconebooks.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-12 21:55:06
(4 months ago)
(mod_security) mod_security (id:210831) triggered by 120.229.152.211 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210831) triggered by 120.229.152.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 17:54:59.104193 2026] [security2:error] [pid 25969:tid 25969] [client 120.229.152.211:14773] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.glolady.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.glolady.com"] [uri "/"] [unique_id "agOhs4lOuAs8Y59m7YrnxgAAABA"], referer: https://www.glolady.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-12 19:57:57
(4 months ago)
(mod_security) mod_security (id:210831) triggered by 120.229.152.211 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210831) triggered by 120.229.152.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 15:57:50.040520 2026] [security2:error] [pid 11040:tid 11079] [client 120.229.152.211:14730] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.secdc.org|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.secdc.org"] [uri "/"] [unique_id "agOGPmVBZRNaVq6bYT4LfAAAAQc"], referer: http://www.secdc.org/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇳
ThreatBook.io
2026-05-10 23:51:34
(4 months ago)
ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.229.152.211
2026-05-10 ...
show more
ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.229.152.211
2026-05-10 03:55:04 /sitemap.xml
show less
Web App Attack
🇨🇳
ThreatBook.io
2026-05-06 00:47:46
(4 months ago)
ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.229.152.211
2026-05-05 ...
show more
ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.229.152.211
2026-05-05 12:41:33 /config.json
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-03-01 17:53:42
(6 months ago)
(mod_security) mod_security (id:210831) triggered by 120.229.152.211 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210831) triggered by 120.229.152.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 01 12:53:26.931769 2026] [security2:error] [pid 22170:tid 22170] [client 120.229.152.211:14522] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.indie100.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.indie100.com"] [uri "/index.html"] [unique_id "aaR9FqSNKC8qLNv8a91ungAAAAo"], referer: https://www.indie100.com/index.html
show less
Brute-Force
Bad Web Bot
Web App Attack