🇺🇸
TPI-Abuse
2026-10-29 16:15:22
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 186.158.120.103 (host103.186-158-120.telmex.net.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 12:15:17.339799 2026] [security2:error] [pid 25791:tid 258 ...
show more
(mod_security) mod_security (id:210350) triggered by 186.158.120.103 (host103.186-158-120.telmex.net.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 12:15:17.339799 2026] [security2:error] [pid 25791:tid 25823] [client 186.158.120.103:3059] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||newyorklifecoach.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "newyorklifecoach.com"] [uri "/links.html"] [unique_id "auNxFXrMhkEMiXapNow8gAAAAQs"], referer: https://newyorklifecoach.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-12 00:32:14
UTC ·
(3 weeks ago)
Not following 301 redirects — wasted requests | method: GET | path: http://escrime-auvergnerhonealpes.fr/calendrier-2/action~agenda/time_limit~1764370800/cat_ids~561/tag_ids~638,565,466/request_fo | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple ...
show more
Not following 301 redirects — wasted requests | method: GET | path: http://escrime-auvergnerhonealpes.fr/calendrier-2/action~agenda/time_limit~1764370800/cat_ids~561/tag_ids~638,565,466/request_fo | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
show less
Bad Web Bot
🇺🇸
鬼影233
2026-09-29 18:10:30
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Bad Web Bot
🇨🇦
Anytech
2026-09-09 10:29:36
UTC ·
(1 month ago)
Blocked by Conn-Monitor: Bad Web Bots
Bad Web Bot
Hacking
Web App Attack
🇺🇸
鬼影233
2026-08-29 13:42:25
UTC ·
(2 months ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-24 14:34:52
UTC ·
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 186.158.120.103 (host103.186-158-120.telmex.net.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 10:34:46.122293 2026] [security2:error] [pid 18380:tid 183 ...
show more
(mod_security) mod_security (id:210350) triggered by 186.158.120.103 (host103.186-158-120.telmex.net.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 10:34:46.122293 2026] [security2:error] [pid 18380:tid 18380] [client 186.158.120.103:5960] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||davidnevue.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "davidnevue.com"] [uri "/wp-content/plugins/adminer/adminer/adminer.php"] [unique_id "aoxWhrtRVemhFn6Gik2JlAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
A000Z
2026-08-22 02:00:05
UTC ·
(2 months ago)
Fail2Ban: 186.158.120.103 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Bad Web Bot
🇩🇪
LRob
2026-08-03 13:39:23
UTC ·
(3 months ago)
CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1764370800/cat_ids~123,673,359/tag_ids~418,248,229,235,824,551,442,480/request_format~jso ...
show more
CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1764370800/cat_ids~123,673,359/tag_ids~418,248,229,235,824,551,442,480/request_format~json/ | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
show less
DDoS Attack
Web App Attack
🇺🇸
kosada.com
2026-08-01 16:51:58
UTC ·
(3 months ago)
Web bot: DDoS
DDoS Attack
Bad Web Bot
2026-07-29 15:34:07
UTC ·
(3 months ago)
denied Telnet access attempt. destination port 23.
Port Scan
Brute-Force
🇺🇸
xmission.com
2026-07-29 13:30:34
UTC ·
(3 months ago)
Blocked by UFW (TCP on 23)
Source port: 10872
TTL: 57
Packet length: 60
TOS: 0x00
This report (for 186.158.120.103) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
Hacking
Brute-Force
🇺🇸
kosada.com
2026-06-29 07:15:03
UTC ·
(4 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇫🇮
notelseit
2026-04-19 14:10:15
UTC ·
(6 months ago)
2026-04-19T16:10:06.022647+02:00 mail dovecot: auth-worker(802346): conn unix:auth-worker (pid=789379,uid=110): auth-worker<66>: sql([email protected] ,186.158.120.103,<7QL1vNBPzdi6nnhn>): unknown user
2026-04-19T16:10:13.923541+02:00 mail dovec ...
show more
2026-04-19T16:10:06.022647+02:00 mail dovecot: auth-worker(802346): conn unix:auth-worker (pid=789379,uid=110): auth-worker<66>: sql([email protected] ,186.158.120.103,<7QL1vNBPzdi6nnhn>): unknown user
2026-04-19T16:10:13.923541+02:00 mail dovecot: auth-worker(802346): conn unix:auth-worker (pid=789379,uid=110): auth-worker<67>: sql([email protected] ,186.158.120.103,<7QL1vNBPzdi6nnhn>): unknown user
2026-04-19T16:10:15.425660+02:00 mail dovecot: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 13 secs): user=<[email protected] >, method=PLAIN, rip=186.158.120.103, lip=65.21.131.50, TLS: Connection closed, session=<7QL1vNBPzdi6nnhn>
...
show less
Brute-Force
Email Spam
🇨🇦
polycoda
2026-02-26 12:08:20
UTC ·
(8 months ago)
🥶 Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27
DDoS Attack
🇺🇸
kosada.com
2026-02-24 16:24:28
UTC ·
(8 months ago)
Web bot: DDoS
DDoS Attack
Bad Web Bot
