🇺🇸
TPI-Abuse
2026-10-17 21:21:10
(9 hours ago)
(mod_security) mod_security (id:210831) triggered by 120.239.31.110 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 120.239.31.110 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 17:21:03.670323 2026] [security2:error] [pid 29455:tid 29455] [client 120.239.31.110:6927] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.mainefirst.org|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.mainefirst.org"] [uri "/"] [unique_id "atPmv-1cdDbqb0mQX9Fq8QAAAAQ"], referer: https://www.mainefirst.org/
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-29 04:33:58
(1 month ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show more
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in email-link.asp
show less
Exploited Host
Bad Web Bot
🇦🇺
paulshipley.com.au
2026-06-27 23:11:48
(3 months ago)
[Sun Jun 28 09:11:47.629915 2026] [security2:error] [pid 869155] [client 120.239.31.110:4296] [clien ...
show more
[Sun Jun 28 09:11:47.629915 2026] [security2:error] [pid 869155] [client 120.239.31.110:4296] [client 120.239.31.110] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mareeshefford.com"] [uri "/"] [unique_id "akBYs4fbANiRzXhYxOo0WgAAAAI"], referer: https://mareeshefford.com/
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-04 20:13:14
(4 months ago)
(mod_security) mod_security (id:210831) triggered by 120.239.31.110 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 120.239.31.110 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 16:13:08.846082 2026] [security2:error] [pid 15312:tid 15312] [client 120.239.31.110:6808] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||astariamusic.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "astariamusic.com"] [uri "/"] [unique_id "aiHcVOCs_UVCGsIuP8d9OQAAAAg"], referer: http://astariamusic.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 01:38:33
(4 months ago)
(mod_security) mod_security (id:210831) triggered by 120.239.31.110 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 120.239.31.110 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 21:38:27.608967 2026] [security2:error] [pid 19360:tid 19360] [client 120.239.31.110:6752] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.ezekielproductions.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.ezekielproductions.com"] [uri "/"] [unique_id "ahzik-CHLNOmYVUC3teSHQAAAAc"], referer: http://www.ezekielproductions.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-12 20:22:35
(5 months ago)
(mod_security) mod_security (id:949110) triggered by 120.239.31.110 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:949110) triggered by 120.239.31.110 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 16:22:31.636208 2026] [security2:error] [pid 27028:tid 27028] [client 120.239.31.110:2605] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "gupta.net"] [uri "/"] [unique_id "agOMB0XSYXyKTbFRzg314wAAAAE"], referer: http://gupta.net/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-03-01 14:43:37
(7 months ago)
Detected mail brute force attack from 4 different servers
Brute-Force
🇺🇸
TPI-Abuse
2026-02-03 14:28:38
(8 months ago)
(mod_security) mod_security (id:210831) triggered by 120.239.31.110 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 120.239.31.110 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 03 09:28:31.922452 2026] [security2:error] [pid 1470:tid 1470] [client 120.239.31.110:3551] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||cgautomatizacion.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "cgautomatizacion.com"] [uri "/index.html"] [unique_id "aYIGD6ooqn11en_P7QIowAAAAAQ"], referer: https://cgautomatizacion.com/index.html
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-02 19:01:04
(8 months ago)
(mod_security) mod_security (id:210831) triggered by 120.239.31.110 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 120.239.31.110 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 02 14:00:59.511922 2026] [security2:error] [pid 5704:tid 5704] [client 120.239.31.110:5506] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||register-yacht-france.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "register-yacht-france.com"] [uri "/"] [unique_id "aYD0a2N3kLm_dLW76DdUcwAAAAA"], referer: http://register-yacht-france.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
IrisFlower
2022-01-26 09:01:25
(4 years ago)
Unauthorized connection attempt detected from IP address 120.239.31.110 to port 443 [J]
Port Scan
Hacking
