🇺🇸
TPI-Abuse
2026-10-27 05:10:57
(14 hours ago)
(mod_security) mod_security (id:210350) triggered by 200.50.233.9 (host-200-50-233-9.fibramax.ec): 1 ...
show more
(mod_security) mod_security (id:210350) triggered by 200.50.233.9 (host-200-50-233-9.fibramax.ec): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 01:10:53.120241 2026] [security2:error] [pid 5661:tid 5661] [client 200.50.233.9:53700] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||nationalenq.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "nationalenq.com"] [uri "/national-enq-the-only-solution-is-an-export-revolution-american-businesses-must-receive-support-to-dramatically-increase-exports"] [unique_id "auAyXQwGHMF5YrhP7VlHewAAAAI"], referer: https://americanexportimport.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
francelink.fr
2026-10-21 07:50:23
(6 days ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-21T05:01:27.000Z.
Web App Attack
🇫🇷
Tilellit.PRO
2026-10-02 05:58:07
(3 weeks ago)
WooCommerce YITH AJAX Filder product_cat filter flood attempt with taxonomies
DDoS Attack
Bad Web Bot
🇺🇸
鬼影233
2026-09-29 06:05:24
(4 weeks ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0. ...
show more
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
show less
Bad Web Bot
🇺🇸
kosada.com
2026-07-26 20:01:56
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2026-06-29 12:34:00
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
2026-05-28 18:07:13
(4 months ago)
Unauthorized VPN login attempts
Hacking
Brute-Force
2026-04-30 19:59:46
(5 months ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show more
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-skip.asp
show less
Exploited Host
Bad Web Bot
🇫🇮
notelseit
2026-04-19 01:16:54
(6 months ago)
2026-04-19T03:15:56.818576+02:00 mail dovecot: auth-worker(740934): conn unix:auth-worker (pid=66849 ...
show more
2026-04-19T03:15:56.818576+02:00 mail dovecot: auth-worker(740934): conn unix:auth-worker (pid=668491,uid=110): auth-worker<52>: sql([email protected] ,200.50.233.9,<cSWM7MVP9KrIMukJ>): unknown user
2026-04-19T03:16:02.999543+02:00 mail dovecot: auth-worker(740934): conn unix:auth-worker (pid=668491,uid=110): auth-worker<53>: sql([email protected] ,200.50.233.9,<cSWM7MVP9KrIMukJ>): unknown user
2026-04-19T03:16:54.348850+02:00 mail dovecot: pop3-login: Disconnected: Connection closed (auth failed, 2 attempts in 58 secs): user=<[email protected] >, method=PLAIN, rip=200.50.233.9, lip=65.21.131.50, TLS: Connection closed, session=<cSWM7MVP9KrIMukJ>
...
show less
Brute-Force
Email Spam
🇳🇱
EGP Abuse Dept
2026-04-07 03:09:16
(6 months ago)
Scraping webshop URLs (creall.com), likely botnet drone
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-04-01 23:41:13
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 200.50.233.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 200.50.233.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 19:41:07.604229 2026] [security2:error] [pid 29693:tid 29693] [client 200.50.233.9:47847] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||lionheartpublications.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lionheartpublications.com"] [uri "/[email protected] "] [unique_id "ac2tE6Cw3J5RXpOQRP_fiQAAABQ"], referer: https://lionheartpublications.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-03-22 00:18:00
(7 months ago)
block ruleset Badbot using very old user-agents 5CF3CDB778C7D82564405B86B9242E612F378C68
Bad Web Bot
🇨🇭
backslash
2026-01-15 01:40:06
(9 months ago)
block ruleset Badbot using very old user-agents 5CF3CDB778C7D82564405B86B9242E612F378C68
Bad Web Bot
🇮🇹
VHosting
2025-12-24 02:30:24
(10 months ago)
Detected attack and reported by a human
DDoS Attack
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
🇩🇪
SMARTNET
2025-11-30 18:38:00
(10 months ago)
Aisuru(Mirai variant) DDoS
DDoS Attack