🇺🇸
TPI-Abuse
2026-11-06 20:18:33
UTC ·
(10 hours ago)
(mod_security) mod_security (id:225170) triggered by 138.84.35.75 (customer.sntochl1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 15:18:26.706910 2026] [security2:error] [pid 2234782:tid 223 ...
show more
(mod_security) mod_security (id:225170) triggered by 138.84.35.75 (customer.sntochl1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 15:18:26.706910 2026] [security2:error] [pid 2234782:tid 2234893] [client 138.84.35.75:46735] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||chaoticperception.cynosureinternetservices.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "chaoticperception.cynosureinternetservices.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "au42EvW3M9dbz4_hl_5UVgAAAdM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 11:47:48
UTC ·
(19 hours ago)
(mod_security) mod_security (id:225170) triggered by 138.84.35.75 (customer.sntochl1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 06:47:41.920416 2026] [security2:error] [pid 16890:tid 16890 ...
show more
(mod_security) mod_security (id:225170) triggered by 138.84.35.75 (customer.sntochl1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 06:47:41.920416 2026] [security2:error] [pid 16890:tid 16890] [client 138.84.35.75:32248] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||takeapawsboston.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "takeapawsboston.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "au2-XQYBDJLUNFDRRwboXAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
IndigoRidge
2026-11-06 11:10:56
UTC ·
(19 hours ago)
138.84.35.75 - - [06/Nov/2026:06:10:50 -0500] "GET /?author=1&feed=rss2 HTTP/1.1" 301 4854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
138.84.35.75 - - [06/Nov/2026:06:10:51 -0 ...
show more
138.84.35.75 - - [06/Nov/2026:06:10:50 -0500] "GET /?author=1&feed=rss2 HTTP/1.1" 301 4854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
138.84.35.75 - - [06/Nov/2026:06:10:51 -0500] "GET /?author=2&feed=rss2 HTTP/1.1" 301 4854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
138.84.35.75 - - [06/Nov/2026:06:10:53 -0500] "GET /?author=3&feed=rss2 HTTP/1.1" 404 37537 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
138.84.35.75 - - [06/Nov/2026:06:10:54 -0500] "GET /?author=4&feed=rss2 HTTP/1.1" 404 37537 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
138.84.35.75 - - [06/Nov/2026:06:10:55 -0500] "GET /?author=5&feed=rss2 HTTP/1.1" 404 37537 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-07 22:36:52
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210350) triggered by 138.84.35.75 (customer.sntochl1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 18:36:45.180921 2026] [security2:error] [pid 11406:tid 11406 ...
show more
(mod_security) mod_security (id:210350) triggered by 138.84.35.75 (customer.sntochl1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 18:36:45.180921 2026] [security2:error] [pid 11406:tid 11406] [client 138.84.35.75:9637] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||vaezi.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "vaezi.com"] [uri "/"] [unique_id "asbJfRvpG8oNxyy_UIYBEgAAAAw"], referer: https://aibacklinkautomation.space/dir/white-hat-link-building-223465
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-10-06 19:12:58
UTC ·
(1 month ago)
HTTP application-layer DoS / botnet traffic from 138.84.35.75: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇨🇭
backslash
2026-08-19 10:12:08
UTC ·
(2 months ago)
block ruleset 39D9DF3582BC0B50B0A9559A2D05D44391E672DC
Bad Web Bot
🇨🇳
Peter Yu
2026-08-18 18:52:33
UTC ·
(2 months ago)
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-08-17 00:11:05
UTC ·
(2 months ago)
Web App Attack
Web App Attack
2026-07-24 12:58:03
UTC ·
(3 months ago)
denied traffic to a honeypot network. destination port 27033.
Port Scan
Hacking
🇺🇸
kosada.com
2026-07-20 01:11:09
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇫🇷
Sklurk
2026-05-10 02:16:08
UTC ·
(5 months ago)
Web App Attack
Web App Attack
🇺🇸
hostseries
2024-06-18 20:22:23
UTC ·
(2 years ago)
Trigger: LF_DISTATTACK
Brute-Force
