🇺🇸
TPI-Abuse
2026-11-07 14:29:53
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 168.121.158.17 (168-121-158-17-dynamic.nrconexoes.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 09:29:46.942912 2026] [security2:error] [pid 24428:t ...
show more
(mod_security) mod_security (id:210350) triggered by 168.121.158.17 (168-121-158-17-dynamic.nrconexoes.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 09:29:46.942912 2026] [security2:error] [pid 24428:tid 24428] [client 168.121.158.17:25085] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||cephedanisman.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cephedanisman.com"] [uri "/en"] [unique_id "au812kSZSNJkE2w2P8UXdwAAAAE"], referer: https://facadeconsultants.net/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-30 08:11:19
UTC ·
(1 week ago)
Proxynvader botnet: code forge crawl | path: /WP/qrcode-maker/issues | src_port: 25936 | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 | 2026-10-30 08:11 UTC
DDoS Attack
Bad Web Bot
🇫🇷
Sklurk
2026-10-22 03:28:06
UTC ·
(2 weeks ago)
Web App Attack
Web App Attack
🇮🇩
hermawan
2026-10-13 01:19:01
UTC ·
(4 weeks ago)
[Tue Oct 13 08:19:00.525542 2026] [security2:error] [pid 581468:tid 140619810744000] [client 168.121.158.17:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.yahoo.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/co ...
show more
[Tue Oct 13 08:19:00.525542 2026] [security2:error] [pid 581468:tid 140619810744000] [client 168.121.158.17:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.yahoo.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "618"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.yahoo.go.id found within REQUEST_HEADERS:referer: https://www.yahoo.go.id/ request_line = GET /index.php/analisis-iklim/analisis-bulanan/analisis-distribusi-hujan/analisis-distribusi-curah-hujan HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/analisis-iklim/analisis-bulanan/analisis-distribusi-hujan/analisis-distribusi-curah-hujan"] [unique_id "as2HBHo8QOD-UypuYGDw9gAAAAM"], referer https://www.yahoo.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[581527] [Gr10mS4DtaU] [as2HBHo8QOD-UypuYGDw9gAAAAM] keep_alive=[0] [2026-10-13 08:19:00.525549] [R:as2HBHo8
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-10-03 01:59:34
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 168.121.158.17 (168-121-158-17-dynamic.nrconexoes.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 21:59:28.146073 2026] [security2:error] [pid 18129:t ...
show more
(mod_security) mod_security (id:210350) triggered by 168.121.158.17 (168-121-158-17-dynamic.nrconexoes.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 21:59:28.146073 2026] [security2:error] [pid 18129:tid 18129] [client 168.121.158.17:28455] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||karyaenigma.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "karyaenigma.com"] [uri "/"] [unique_id "asBhgDLI4tDEYjgNQoVAqwAAACA"], referer: https://seobacklinkbuildingservices.space/dir/website-ranking-links-111574
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-10-01 10:30:19
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-24 06:17:09
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-24 05:32:29
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-22 17:55:58
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 168.121.158.17 (168-121-158-17-dynamic.nrconexoes.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 13:55:53.277984 2026] [security2:error] [pid 27477:t ...
show more
(mod_security) mod_security (id:210350) triggered by 168.121.158.17 (168-121-158-17-dynamic.nrconexoes.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 13:55:53.277984 2026] [security2:error] [pid 27477:tid 27477] [client 168.121.158.17:64822] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jrbentley.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jrbentley.com"] [uri "/"] [unique_id "arLBKTI7JSWs-UTFRpkCMAAAAAg"], referer: https://cartertools.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
bigorre.org
2026-09-15 17:14:41
UTC ·
(1 month ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
🇺🇸
kosada.com
2026-08-25 11:44:46
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇩🇪
LRob
2026-08-19 02:08:18
UTC ·
(2 months ago)
L7 DDoS: distributed flood on a shop's faceted search — automated requests to search/sort URLs, one or two per address from thousands of addresses, no page assets loaded | path: /116-vtt | query: order=product.position.asc&productListView=list&q=Tail ...
show more
L7 DDoS: distributed flood on a shop's faceted search — automated requests to search/sort URLs, one or two per address from thousands of addresses, no page assets loaded | path: /116-vtt | query: order=product.position.asc&productListView=list&q=Taille-S%2FMarque-Lapierre%2FAnn%C3%A9e-2026
show less
DDoS Attack
Web App Attack
🇺🇸
kosada.com
2026-08-11 04:42:40
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-02 20:55:29
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 168.121.158.17 (168-121-158-17-dynamic.nrconexoes.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 02 16:55:24.970398 2026] [security2:error] [pid 1450411 ...
show more
(mod_security) mod_security (id:225170) triggered by 168.121.158.17 (168-121-158-17-dynamic.nrconexoes.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 02 16:55:24.970398 2026] [security2:error] [pid 1450411:tid 1450411] [client 168.121.158.17:24466] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||alsdepot.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "alsdepot.com"] [uri "/wp-json/wp/v2/users"] [unique_id "am-uvC56lLfsXogGZ2fYhQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-07-31 03:13:40
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
