🇪🇸
librebit
2026-11-08 00:52:36
UTC ·
(1 hour ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-11-07 21:41:16
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210350) triggered by 181.209.97.122 (122.97.209.181.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 16:41:10.255670 2026] [security2:error] [pid 9701:tid 9701] [clie ...
show more
(mod_security) mod_security (id:210350) triggered by 181.209.97.122 (122.97.209.181.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 16:41:10.255670 2026] [security2:error] [pid 9701:tid 9701] [client 181.209.97.122:27396] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||hiddentcgcards.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "hiddentcgcards.com"] [uri "/"] [unique_id "au-a9gHoRutraM5blIicvQAAAAw"], referer: https://chunkyjwes.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 14:04:23
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 181.209.97.122 (122.97.209.181.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 10:04:16.105429 2026] [security2:error] [pid 6681:tid 6681] [clie ...
show more
(mod_security) mod_security (id:210350) triggered by 181.209.97.122 (122.97.209.181.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 10:04:16.105429 2026] [security2:error] [pid 6681:tid 6681] [client 181.209.97.122:35908] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||michleen-collins.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "michleen-collins.com"] [uri "/"] [unique_id "auNSYI2ic14HlMS7fATFhQAAABI"], referer: https://five.co.in/redirect.php?ref_host=aprendisiones.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-10-01 07:13:48
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Bad Web Bot
🇺🇸
鬼影233
2026-09-30 12:52:36
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Bad Web Bot
🇺🇸
鬼影233
2026-09-24 10:51:50
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-24 03:57:18
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 181.209.97.122 (122.97.209.181.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 23:57:12.725407 2026] [security2:error] [pid 12225:tid 12225] [cl ...
show more
(mod_security) mod_security (id:210350) triggered by 181.209.97.122 (122.97.209.181.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 23:57:12.725407 2026] [security2:error] [pid 12225:tid 12225] [client 181.209.97.122:26554] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||technology-connection.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "technology-connection.net"] [uri "/"] [unique_id "arSfmKZMQ6q7BjnveS7rrAAAABI"], referer: https://hcctkarmalike.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
librebit
2026-09-21 02:31:04
UTC ·
(1 month ago)
Brute force
Brute-Force
🇺🇸
鬼影233
2026-09-20 07:46:13
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-16 11:22:03
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 181.209.97.122 (122.97.209.181.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 07:21:55.472180 2026] [security2:error] [pid 2545757:tid 2545757] ...
show more
(mod_security) mod_security (id:210492) triggered by 181.209.97.122 (122.97.209.181.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 07:21:55.472180 2026] [security2:error] [pid 2545757:tid 2545757] [client 181.209.97.122:50538] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "automatebi.com"] [uri "/temp/.env.dist"] [unique_id "aqp7048BaIn9NbZEy50HuwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-09-07 02:30:05
UTC ·
(2 months ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]/search?f%5B0%5D=digest_key_terms%3A324&f%5B1%5D=digest_key_terms%3A337&f%5B2%5D=digest_key_terms%3A370&field_article_edition%5B504%5D=504&field_key_terms%5B392%5D ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]/search?f%5B0%5D=digest_key_terms%3A324&f%5B1%5D=digest_key_terms%3A337&f%5B2%5D=digest_key_terms%3A370&field_article_edition%5B504%5D=504&field_key_terms%5B392%5D=392 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
🇺🇸
鬼影233
2026-09-05 18:07:15
UTC ·
(2 months ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-08-30 04:18:51
UTC ·
(2 months ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
kosada.com
2026-08-25 03:55:23
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇨🇭
backslash
2026-08-23 19:42:02
UTC ·
(2 months ago)
block ruleset 019CDF5781F2E2F756268A5E3DF84C9981B56C63
Bad Web Bot
