186.0.248.94

pdf scraper

(mod_security) mod_security (id:210350) triggered by 186.0.248.94 (ip-94-248-0-186.static.silicanetworks.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 12:04:01.241459 2026] [security2:error] [pid 18185:ti ... show more (mod_security) mod_security (id:210350) triggered by 186.0.248.94 (ip-94-248-0-186.static.silicanetworks.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 12:04:01.241459 2026] [security2:error] [pid 18185:tid 18185] [client 186.0.248.94:38894] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||persnicketyinc.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "persnicketyinc.com"] [uri "/about"] [unique_id "auIc8fB7p-IsQWgSeu6bAwAAAAI"], referer: https://greetingcard.org/louie-awards-call-for-entries-information show less

(mod_security) mod_security (id:210350) triggered by 186.0.248.94 (ip-94-248-0-186.static.silicanetworks.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 13:00:15.855424 2026] [security2:error] [pid 10529:ti ... show more (mod_security) mod_security (id:210350) triggered by 186.0.248.94 (ip-94-248-0-186.static.silicanetworks.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 13:00:15.855424 2026] [security2:error] [pid 10529:tid 10529] [client 186.0.248.94:51554] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||whitetaildetailing.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "whitetaildetailing.com"] [uri "/"] [unique_id "asE0n74Sq2ISToeXw_V8LQAAAAs"], referer: https://backlinkbuildingagency.site/dir/trusted-backlink-services-231893 show less

Web App Attack

UDP flood (DDoS) vs AS215599: 810 pkts / 1.16 MB to UDP 80/8443 across 59 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised hos ... show more UDP flood (DDoS) vs AS215599: 810 pkts / 1.16 MB to UDP 80/8443 across 59 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less

UDP flood (DDoS) vs AS215599: 810 pkts / 1.16 MB to UDP 80/8443 across 59 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised hos ... show more UDP flood (DDoS) vs AS215599: 810 pkts / 1.16 MB to UDP 80/8443 across 59 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less

Large-scale coordinated botnet (1.2M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]); Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]) employed by Angara Technologies Group | Attack Signature ... show more Large-scale coordinated botnet (1.2M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]); Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]) employed by Angara Technologies Group | Attack Signature Blocked: /catalog/product_compare/add/product/4206/uenc/aHR0cHM6Ly93d3cuZDJvZmZpY2UucnUvY2F0YWxvZ3NlYXJjaC9yZXN1bHQvP2NhdD0zNzQmYW1wO3A9MyZhbXA7cT1leHRyb24,/form_key/SD6MXzMYyMPTYe9D/ | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6 rv:4.0; bho-IN) AppleWebKit/531.21.3 (KHTML, like Gecko) Version/5.0 Safari/531.21.3 | (Magento Site) show less

Fail2Ban Triggered By 186.0.248.94

Blocked by UFW (TCP on 22) Source port: 40326 TTL: 56 Packet length: 60 TOS: 0x00 This report (for 186.0.248.94) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter

2026-08-11T11:42:08.355690 rhel-20gb-ash-1 sshd[441423]: error: kex_exchange_identification: Connection closed by remote host 2026-08-11T11:42:08.355727 rhel-20gb-ash-1 sshd[441423]: Connection closed by 186.0.248.94 port 42984 ...

2026-08-06 00:09:47 UTC Unauthorized activity to TCP port 23. Telnet

MatShield L7: blocked on mathost.eu (ua-quarantined)