🇫🇷
pm33
2026-06-27 05:18:57
(1 day ago)
Unauthorized connections HTTP 403
Web App Attack
🇵🇱
sefinek.net
2026-06-20 23:29:22
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from IN.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (G ...
show more
Triggered Cloudflare WAF (firewallCustom) from IN.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (GET) | Endpoint: /welcome | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇭🇰
Harold Wong
2026-06-19 03:35:18
(1 week ago)
$f2bV_matches
Brute-Force
🇺🇸
TPI-Abuse
2026-06-17 15:52:04
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 168.144.119.157 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 168.144.119.157 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 11:52:00.223435 2026] [security2:error] [pid 16464:tid 16464] [client 168.144.119.157:41466] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||autodiscover.nancyscafeandcatering.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "autodiscover.nancyscafeandcatering.com"] [uri "/"] [unique_id "ajLCoM_4cSA_totAjeIafAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-16 08:49:14
(1 week ago)
[Tue Jun 16 10:49:13.473452 2026] [authz_core:error] [pid 23617] [client 168.144.119.157:13256] AH01 ...
show more
[Tue Jun 16 10:49:13.473452 2026] [authz_core:error] [pid 23617] [client 168.144.119.157:13256] AH01630: client denied by server configuration: /etc/httpd/htdocs
[Tue Jun 16 10:49:13.473939 2026] [authz_core:error] [pid 24031] [client 168.144.119.157:13270] AH01630: client denied by server configuration: /etc/httpd/htdocs
[Tue Jun 16 10:49:13.488591 2026] [authz_core:error] [pid 23483] [client 168.144.119.157:13246] AH01630: client denied by server configuration: /etc/httpd/htdocs
...
show less
Web App Attack
🇺🇸
kosada.com
2026-06-16 06:21:35
(1 week ago)
Web vulnerability probing: / (bogus vhost/SNI)
Web App Attack
🇩🇪
MBombeck
2026-06-13 21:39:32
(2 weeks ago)
Fail2Ban/traefik-botsearch on apps-01: banned after 5 failures
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 11:02:17
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 168.144.119.157 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 168.144.119.157 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 07:02:09.647564 2026] [security2:error] [pid 9324:tid 9324] [client 168.144.119.157:3498] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.davidnevue.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.davidnevue.com"] [uri "/"] [unique_id "ai04sa6PK6OtxrEo4hiJogAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 17:11:56
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 168.144.119.157 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 168.144.119.157 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 13:11:52.010714 2026] [security2:error] [pid 23654:tid 23654] [client 168.144.119.157:42142] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||autodiscover.casadelsolmexico.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "autodiscover.casadelsolmexico.net"] [uri "/"] [unique_id "airsWJUILfDTtd13tYuzQAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
cybertailor
2026-06-11 13:31:47
(2 weeks ago)
168.144.119.157 - - [11/Jun/2026:18:31:44 +0500] "GET / HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Macintos ...
show more
168.144.119.157 - - [11/Jun/2026:18:31:44 +0500] "GET / HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.0 Safari/537.36"
168.144.119.157 - - [11/Jun/2026:18:31:44 +0500] "GET / HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.0 Safari/537.36"
168.144.119.157 - - [11/Jun/2026:18:31:44 +0500] "GET / HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.0 Safari/537.36"
168.144.119.157 - - [11/Jun/2026:18:31:44 +0500] "GET / HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.0 Safari/537.36"
168.144.119.157 - - [11/Jun/2026:18:31:44 +0500] "GET / HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.0 Safari/537.36"
...
show less
Port Scan
🇺🇸
TPI-Abuse
2026-06-10 13:33:31
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 168.144.119.157 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 168.144.119.157 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 09:33:25.445798 2026] [security2:error] [pid 29386:tid 29432] [client 168.144.119.157:47164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||gsji.org.aafm.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "gsji.org.aafm.us"] [uri "/"] [unique_id "ailnpY1YasQ5d-R5pGLh3QAAAMQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-06-09 19:08:28
(2 weeks ago)
{"level":"info","ts":1781029584.9172113,"logger":"http.log.access.log0","msg":"handled request","req ...
show more
{"level":"info","ts":1781029584.9172113,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"168.144.119.157","remote_port":"16888","client_ip":"168.144.119.157","proto":"HTTP/1.1","method":"GET","host":"mtwx.status.updown.io","uri":"/","headers":{"User-Agent":["Go-http-client/1.1"],"Connection":["close"],"Accept-Encoding":["gzip"]}},"bytes_read":0,"user_id":"","duration":0.000071827,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://mtwx.status.updown.io/"],"Content-Type":[]}}
{"level":"info","ts":1781029612.5314882,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"168.144.119.157","remote_port":"28594","client_ip":"168.144.119.157","proto":"HTTP/1.1","method":"GET","host":"9ary.status.updown.io","uri":"/","headers":{"Accept-Encoding":["gzip"],"User-Agent":["Go-http-client/1.1"],"Connection":["close"]}},"bytes_read":0,"user_id":"","duration":0.0000735,"size":0,"status":308,"resp_
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 12:58:14
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 168.144.119.157 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 168.144.119.157 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 08:58:07.088988 2026] [security2:error] [pid 20905:tid 20905] [client 168.144.119.157:62430] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.achillespress.com.tandm.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.achillespress.com.tandm.us"] [uri "/"] [unique_id "aigN3-tMWXHC3ZBSwTIynwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 19:16:13
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 168.144.119.157 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 168.144.119.157 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 15:16:09.543576 2026] [security2:error] [pid 27799:tid 27799] [client 168.144.119.157:51690] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.willmarksynthetics.cosentient.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.willmarksynthetics.cosentient.com"] [uri "/"] [unique_id "ah8r-UQRO3oZVJ5_Y0sTMQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-06-01 23:05:09
(3 weeks ago)
22.100 requests in 1 hour (1w1h59m)
Brute-Force
Bad Web Bot