🇺🇸
TPI-Abuse
2026-11-11 22:39:43
UTC ·
(3 hours ago)
(mod_security) mod_security (id:210350) triggered by 122.8.45.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:39:37.858310 2026] [security2:error] [pid 12213:tid 12213] [client 122.8.45.178:13915] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 122.8.45.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:39:37.858310 2026] [security2:error] [pid 12213:tid 12213] [client 122.8.45.178:13915] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ideaofauniversity.website|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ideaofauniversity.website"] [uri "/university-residences/"] [unique_id "avTuqdzD0Wxf3gVseWB2qwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-10 20:00:14
UTC ·
(1 day ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-04 04:45:56
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 122.8.45.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 23:45:49.063872 2026] [security2:error] [pid 28218:tid 28218] [client 122.8.45.178:33053] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 122.8.45.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 23:45:49.063872 2026] [security2:error] [pid 28218:tid 28218] [client 122.8.45.178:33053] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cyclingboardgames.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cyclingboardgames.net"] [uri "/"] [unique_id "auq4fTAvy1097QbAjYYUTQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-01 00:32:06
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 13:27:51
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 122.8.45.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 09:27:46.803936 2026] [security2:error] [pid 14727:tid 14727] [client 122.8.45.178:17625] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 122.8.45.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 09:27:46.803936 2026] [security2:error] [pid 14727:tid 14727] [client 122.8.45.178:17625] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||sydneysue.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "sydneysue.com"] [uri "/spiders-in-the-news.html"] [unique_id "auXs0oJO_lOySZ48y1fA4QAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 14:18:17
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 122.8.45.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:18:12.679742 2026] [security2:error] [pid 28987:tid 28987] [client 122.8.45.178:60309] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 122.8.45.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:18:12.679742 2026] [security2:error] [pid 28987:tid 28987] [client 122.8.45.178:60309] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.evannine.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.evannine.com"] [uri "/qa.htm"] [unique_id "atDgpGwXF5sZTQNdoAV0DAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 13:55:06
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 122.8.45.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:54:45.140975 2026] [security2:error] [pid 22638:tid 22638] [client 122.8.45.178:46431] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 122.8.45.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:54:45.140975 2026] [security2:error] [pid 22638:tid 22638] [client 122.8.45.178:46431] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.crearetest.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.crearetest.com"] [uri "/faretest-476-Test_3_Svi.php"] [unique_id "atDbJUAOHfAsMw0iNS5phQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Ilop
2026-09-01 00:04:49
UTC ·
(2 months ago)
[hp-100] 19 unsolicited packets to honeypot ports 9000 (OCI DShield sensor)
Port Scan
🇩🇪
Ilop
2026-08-25 00:05:16
UTC ·
(2 months ago)
[hp-100] 15 unsolicited packets to honeypot ports 8080 (OCI DShield sensor)
Port Scan
🇳🇱
DonAtari
2026-08-23 10:44:11
UTC ·
(2 months ago)
DShield firewall scan - TCP to port 7547
Brute-Force
SSH
2026-07-03 08:49:15
UTC ·
(4 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇧🇪
Saec
2026-06-20 22:15:10
UTC ·
(4 months ago)
Jarvis auto-ban: CF honeypot path /xmlrpc.php (3× on saec.me)
Port Scan
Web App Attack
🇫🇷
Tilellit.PRO
2026-06-15 02:28:05
UTC ·
(4 months ago)
Fail2Ban banned 122.8.45.178 for security violations in jail wp-armour. Log: 2026/06/15 02:28:05 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 122.8.45.178 | Target: wplogin" , client: 122.8.45.178, server: [REDACTED], request: "P ...
show more
Fail2Ban banned 122.8.45.178 for security violations in jail wp-armour. Log: 2026/06/15 02:28:05 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 122.8.45.178 | Target: wplogin" , client: 122.8.45.178, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
2026-06-12 20:43:24
UTC ·
(4 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇩🇪
Fusl
2023-04-17 11:14:50
UTC ·
(3 years ago)
received unsolicited smtp data stream:
Date: Mon, 17 Apr 2023 07:08:02 -0400
From: [email protected]
Subject: Delivery report
To: [email protected]
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
...
show more
received unsolicited smtp data stream:
Date: Mon, 17 Apr 2023 07:08:02 -0400
From: [email protected]
Subject: Delivery report
To: [email protected]
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="[email protected] "
[email protected]
Content-Type: text/plain
Hello, this is the mail server on vfusqmtnekdi.com.
I am sending you this message to inform you on the delivery status of a
message you previously sent. Immediately below you will find a list of
the affected recipients; also attached is a Delivery Status Notification
(DSN) report in standard format, as well as the headers of the original
message.
<[email protected] > delivery failed; will not continue trying
[email protected]
Content-Type: message/delivery-status
Original-Envelope-Id: 383;639855;0000007010;pawan1
Reporting-MTA: dns;vfusqmtnekdi.com
X-PowerMTA-VirtualMTA: nvmta_0421
Received-From-MTA: dns;localhost (127.0.0.1)
Arrival-Dat
show less
Email Spam
