🇺🇸
Zandro
2026-11-07 20:00:14
UTC ·
(6 days ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇫🇷
Sklurk
2026-11-03 23:59:55
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇫🇷
Sklurk
2026-11-01 00:38:14
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 08:23:15
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.19.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 04:23:09.154155 2026] [security2:error] [pid 32069:tid 32069] [client 157.22.19.24:35331] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.19.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 04:23:09.154155 2026] [security2:error] [pid 32069:tid 32069] [client 157.22.19.24:35331] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2021/09/12/unlocked-feb-23-2021-the-american-protective-league-feat-housetrotter-arsenal-for-democracy-ep-353/"] [unique_id "auWlbdc_8l7ot5GgtqMLVQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 17:02:12
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.19.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 13:02:09.067947 2026] [security2:error] [pid 30670:tid 30670] [client 157.22.19.24:21269] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.19.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 13:02:09.067947 2026] [security2:error] [pid 30670:tid 30670] [client 157.22.19.24:21269] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||chrisbilder.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "chrisbilder.com"] [uri "/research/ArrayMultiplex/Hierarchical.cpp"] [unique_id "auTNkYOjCtAHHeI4Bel1wAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-30 14:56:16
UTC ·
(2 weeks ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-skip.asp
Exploited Host
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-28 19:17:05
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.19.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:16:59.197159 2026] [security2:error] [pid 15877:tid 15877] [client 157.22.19.24:29093] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.19.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:16:59.197159 2026] [security2:error] [pid 15877:tid 15877] [client 157.22.19.24:29093] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||colbygrenier.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "colbygrenier.com"] [uri "/code/videoplayer.html"] [unique_id "auJKKyn3WA3xuxWTog2oEAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 18:16:07
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.19.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 14:16:01.413975 2026] [security2:error] [pid 20134:tid 20147] [client 157.22.19.24:42119] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.19.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 14:16:01.413975 2026] [security2:error] [pid 20134:tid 20147] [client 157.22.19.24:42119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.financialanalyst.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.financialanalyst.org"] [uri "/ce.html"] [unique_id "at-Y4aUQvFL1fdNL0pA9tQAAAIs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 01:31:47
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.19.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 21:31:42.404650 2026] [security2:error] [pid 11194:tid 11194] [client 157.22.19.24:20563] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.19.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 21:31:42.404650 2026] [security2:error] [pid 11194:tid 11194] [client 157.22.19.24:20563] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.vexxarr.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.vexxarr.com"] [uri "/archive.php"] [unique_id "atlnfi6Y4LSnlLMLB6ihrwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
C C
2026-08-12 00:07:25
UTC ·
(3 months ago)
Distributed scraping attack: 1244 req from 1212 rotating proxy IPs | this IP: 1 req
Open Proxy
Bad Web Bot
Exploited Host
Web App Attack
🇵🇱
sefinek.net
2026-05-31 21:44:15
UTC ·
(5 months ago)
Triggered Cloudflare WAF (firewallCustom) from FI.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: / | UA: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
Bad Web Bot
