🇺🇸
TPI-Abuse
2026-11-15 19:27:21
UTC ·
(2 minutes ago)
(mod_security) mod_security (id:210350) triggered by 189.6.9.140 (bd06098c.virtua.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 14:27:15.005781 2026] [security2:error] [pid 28622:tid 28622] [client 189 ...
show more
(mod_security) mod_security (id:210350) triggered by 189.6.9.140 (bd06098c.virtua.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 14:27:15.005781 2026] [security2:error] [pid 28622:tid 28622] [client 189.6.9.140:35632] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||amprosoft.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "amprosoft.com"] [uri "/sitemap.xml"] [unique_id "avoHkmZAIWGhHbZ_mNE9twAAAAQ"], referer: https://amprosoft.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 00:35:08
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 189.6.9.140 (bd06098c.virtua.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 20:35:03.624742 2026] [security2:error] [pid 28487:tid 28487] [client 189 ...
show more
(mod_security) mod_security (id:210350) triggered by 189.6.9.140 (bd06098c.virtua.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 20:35:03.624742 2026] [security2:error] [pid 28487:tid 28487] [client 189.6.9.140:35344] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.southsideaccountingservices.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.southsideaccountingservices.com"] [uri "/"] [unique_id "at_xtyKzg7xNNJ5d2s0YpAAAAAA"], referer: https://five.co.in/redirect.php?ref_host=urlaub-in-schweden.info
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 02:26:44
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 189.6.9.140 (bd06098c.virtua.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 22:26:37.673780 2026] [security2:error] [pid 24011:tid 24011] [client 189 ...
show more
(mod_security) mod_security (id:210350) triggered by 189.6.9.140 (bd06098c.virtua.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 22:26:37.673780 2026] [security2:error] [pid 24011:tid 24011] [client 189.6.9.140:35575] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.spacebooger.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.spacebooger.com"] [uri "/"] [unique_id "atrF3e7P4UeHV199yyXoWQAAAAY"], referer: https://stars-and-garters.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-03 14:56:49
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 189.6.9.140 (bd06098c.virtua.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 10:56:41.234216 2026] [security2:error] [pid 19869:tid 19869] [client 189 ...
show more
(mod_security) mod_security (id:210350) triggered by 189.6.9.140 (bd06098c.virtua.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 10:56:41.234216 2026] [security2:error] [pid 19869:tid 19869] [client 189.6.9.140:22139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||angelsofrhodeisland.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "angelsofrhodeisland.com"] [uri "/"] [unique_id "asEXqbjrvChR-k2UiOEwvAAAAAg"], referer: https://automatedbacklinkmaker.space/dir/premium-link-building-9931
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-09-28 07:23:51
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Bad Web Bot
🇳🇱
DrLex0
2026-09-10 03:47:00
UTC ·
(2 months ago)
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives
189.6.9.140 443 - [10/Sep/2026:03:47:00 +0000] "GET [redacted] HTTP/1.1" 410 6184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15 ...
show more
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives
189.6.9.140 443 - [10/Sep/2026:03:47:00 +0000] "GET [redacted] HTTP/1.1" 410 6184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
show less
Bad Web Bot
Exploited Host
🇳🇱
exxos
2025-08-30 04:03:01
UTC ·
(1 year ago)
Attacks with Bad user agents
Hacking
🇳🇱
exxos
2025-07-27 22:31:14
UTC ·
(1 year ago)
web exploit attacks
Web App Attack
🇳🇱
exxos
2025-06-29 12:41:57
UTC ·
(1 year ago)
web exploit attacks
Web App Attack
