🇵🇱
mkey
2026-10-13 01:20:03
(3 days ago)
Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT | PORTS ...
show more
Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT | PORTS=23 | HITS=2 | IPSET=ADD | FIRST=2026-10-13 03:14:28 | LAST=2026-10-13 03:14:29. Last seen 2026-10-13 03:14:29.
show less
Port Scan
🇺🇸
xmission.com
2026-10-12 11:40:30
(4 days ago)
Blocked by UFW (TCP on 23)
Source port: 33194
TTL: 47
Packet length: 60
TOS: 0x00
This report (for ...
show more
Blocked by UFW (TCP on 23)
Source port: 33194
TTL: 47
Packet length: 60
TOS: 0x00
This report (for 138.252.144.119) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
Hacking
Brute-Force
🇫🇷
security.rdmc.fr
2026-10-11 00:26:10
(5 days ago)
Port Scan Attack proto:TCP src:57964 dst:23
Port Scan
🇺🇸
m2jest1c
2026-10-10 21:55:05
(6 days ago)
2026-10-10T17:55:04.904657 rhel-20gb-ash-1 sshd[1949553]: error: kex_exchange_identification: Connec ...
show more
2026-10-10T17:55:04.904657 rhel-20gb-ash-1 sshd[1949553]: error: kex_exchange_identification: Connection closed by remote host
2026-10-10T17:55:04.904685 rhel-20gb-ash-1 sshd[1949553]: Connection closed by 138.252.144.119 port 59996
...
show less
Brute-Force
SSH
🇩🇪
Vegascosmetics
2026-10-10 02:40:12
(6 days ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after first-seen suspicion / AbuseIPDB repu ...
show more
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after first-seen suspicion / AbuseIPDB reputation policy (no URL signature). Evidence: Suspicion-Ban (Score 66>=65, Abuse 63, NonEU, first-seen, Change* path)
show less
Hacking
Exploited Host
Web App Attack
🇺🇸
kosada.com
2026-10-09 09:17:38
(1 week ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=31&topics%5B2%5D=44&topics%5B3%5D=39&topics%5B4%5D=40 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.3 Safari/605.1.15")
show less
DDoS Attack
Bad Web Bot
2026-10-08 20:48:40
(1 week ago)
apache vulnerability scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 03:44:16
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 138.252.144.119 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 138.252.144.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 23:44:11.569340 2026] [security2:error] [pid 8389:tid 8389] [client 138.252.144.119:40174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.inverzona.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.inverzona.com"] [uri "/"] [unique_id "asRuiwtMkVkgFQVfOY5kyQAAAAw"], referer: https://backlinkgenerators.shop/dir/professional-backlink-building-102154
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Tsumugi Kotobuki
2026-10-05 08:51:29
(1 week ago)
Port Scan on Honeypot | Ports: 22/SSH | Proto: TCP(1) | Flags: all SYN | TTL: 39 | Len: 60B | Win: 6 ...
show more
Port Scan on Honeypot | Ports: 22/SSH | Proto: TCP(1) | Flags: all SYN | TTL: 39 | Len: 60B | Win: 65535(1) | F2B/ufw-honeypot@2026-10-05T08:51:29Z
show less
Port Scan
Hacking
🇺🇸
cybsecaoccol
2026-10-04 04:35:08
(1 week ago)
unauthorized connection or malicious port scan attempted on tcp port - corp
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-10-04 04:12:17
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 138.252.144.119 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 138.252.144.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 00:12:11.241314 2026] [security2:error] [pid 27772:tid 27772] [client 138.252.144.119:35176] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||texasbordertours.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "texasbordertours.com"] [uri "/"] [unique_id "asHSG4n287lTPgq6l-Hs1QAAAA0"], referer: https://effectivelinkbuilding.site/dir/high-da-backlinks-206668
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-03 10:13:33
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 138.252.144.119 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 138.252.144.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 06:13:25.910546 2026] [security2:error] [pid 32143:tid 32143] [client 138.252.144.119:46458] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||swindon-itf.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "swindon-itf.com"] [uri "/"] [unique_id "asDVRZUzeM8pPqxY9BcXSwAAAAI"], referer: https://linkbuildingfreelancer.shop/dir/seo-ranking-links-202122
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
NetVexor
2026-10-03 03:08:19
(1 week ago)
Attack source identified and submitted via NetVexor BGP Blackhole Network
Port Scan
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-10-02 18:38:21
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 138.252.144.119 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 138.252.144.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 14:38:16.034623 2026] [security2:error] [pid 27709:tid 27709] [client 138.252.144.119:46718] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||propertysubscription.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "propertysubscription.com"] [uri "/"] [unique_id "ar_6GO7v2wPMVFWJQYgB7gAAABo"], referer: https://directorylinks.website/dir/professional-backlink-building-167854
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-02 09:01:13
(2 weeks ago)
[Firewall] Blacklisted: manual | ISP: Pan M Tech Limited | Origin: Bhatara, Bangladesh | Prior Abuse ...
show more
[Firewall] Blacklisted: manual | ISP: Pan M Tech Limited | Origin: Bhatara, Bangladesh | Prior AbuseIPDB score: 30% (4 reports) | Blocked at: 2026-10-02 02:41:34
show less
Brute-Force