🇺🇸
TPI-Abuse
2026-10-12 05:45:16
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 181.80.39.17 (host17.181-80-39.telecom.net.ar): ...
show more
(mod_security) mod_security (id:210350) triggered by 181.80.39.17 (host17.181-80-39.telecom.net.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 01:45:11.557915 2026] [security2:error] [pid 20854:tid 20854] [client 181.80.39.17:59160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||orientaltb.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "orientaltb.com"] [uri "/"] [unique_id "asxz508ja3qqlTsIAiaBfgAAACU"], referer: https://addurl.in/redirect.php?ref_host=galadetenores.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-26 16:00:37
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 181.80.39.17 (host17.181-80-39.telecom.net.ar): ...
show more
(mod_security) mod_security (id:210730) triggered by 181.80.39.17 (host17.181-80-39.telecom.net.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 12:00:19.790228 2026] [security2:error] [pid 18259:tid 18259] [client 181.80.39.17:60980] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||coretherapyassoc.com.praemiumtech.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "coretherapyassoc.com.praemiumtech.com"] [uri "/wp-content/members.db"] [unique_id "arfsE0OLAgIMS-Ewnx1uYgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
nyuuzyou
2026-09-08 15:55:05
(1 month ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on applic ...
show more
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-09-08T15:55:05Z.
show less
Bad Web Bot
🇺🇸
kosada.com
2026-08-26 18:34:03
(1 month ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇩🇪
Admins@FBN
2026-08-22 12:30:33
(1 month ago)
FW-PortScan: Traffic Blocked srcport=36580 dstport=22
Port Scan
Hacking
SSH
🇧🇾
stroytrest
2026-08-17 00:50:36
(2 months ago)
2026-08-17T03:50:35.840258+03:00 gate kernel: [482955.537306] nftables: JAIL-SSH IN=wan OUT= MAC= SR ...
show more
2026-08-17T03:50:35.840258+03:00 gate kernel: [482955.537306] nftables: JAIL-SSH IN=wan OUT= MAC= SRC=181.80.39.17 DST=xxx.xxx.xxx.xxx LEN=60 TOS=0x00 PREC=0x00 TTL=41 ID=60140 DF PROTO=TCP SPT=50148 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇹🇷
SeczarSecureOps
2026-08-10 09:38:45
(2 months ago)
Auto-blocked by Seczar SecureOps — High-Risk Port Probe (admin-managed entries) — SSH (6 events in 5 ...
show more
Auto-blocked by Seczar SecureOps — High-Risk Port Probe (admin-managed entries) — SSH (6 events in 5min) at 2026-08-10 09:38
show less
Web App Attack
🇩🇪
LRob
2026-08-06 15:19:10
(2 months ago)
CrowdSec: REPEAT OFFENDER (previously banned, came back) - distributed L7 HTTP flood on WordPress 'T ...
show more
CrowdSec: REPEAT OFFENDER (previously banned, came back) - distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1763161200/cat_ids~144,158/tag_ids~241,553,226,484,580/request_format~json/ | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-01-16 02:45:15
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 181.80.39.17 (host17.181-80-39.telecom.net.ar): ...
show more
(mod_security) mod_security (id:210492) triggered by 181.80.39.17 (host17.181-80-39.telecom.net.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 15 21:45:04.555951 2026] [security2:error] [pid 2916683:tid 2916699] [client 181.80.39.17:44107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thedowntonstory.com"] [uri "/.git/config"] [unique_id "aWmmMGy10VcM2UHoDldhEwAAAU0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-24 20:35:46
(10 months ago)
scanning http requests from known botnet
Web App Attack
2025-11-21 22:36:59
(10 months ago)
scanning http requests from known botnet
Web App Attack
🇳🇱
exxos
2025-07-30 01:01:51
(1 year ago)
http-no-verb
Hacking
🇳🇱
exxos
2025-07-28 04:22:42
(1 year ago)
http-no-verb
Hacking
🇳🇱
exxos
2025-07-28 02:22:04
(1 year ago)
http-no-verb
Hacking
🇳🇱
exxos
2025-07-27 23:17:39
(1 year ago)
http-no-verb
Hacking