🇺🇸
TPI-Abuse
2026-11-12 19:20:55
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 201.218.159.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 14:20:52.302792 2026] [security2:error] [pid 14508:tid 14508] [client 201.218.159.154:3283 ...
show more
(mod_security) mod_security (id:210350) triggered by 201.218.159.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 14:20:52.302792 2026] [security2:error] [pid 14508:tid 14508] [client 201.218.159.154:32838] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ehrlichfamily.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ehrlichfamily.com"] [uri "/"] [unique_id "avYRlN-EtHv0H1t7dQL5mQAAAAY"], referer: https://allinone.co.in/redirect.php?ref_host=nanotechsuit.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-11-11 21:14:43
UTC ·
(2 days ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=89&topics%5B3%5D=62&topics%5B4%5D=29&topics%5B5%5D=66 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/5 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=89&topics%5B3%5D=62&topics%5B4%5D=29&topics%5B5%5D=66 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-08 06:47:26
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 201.218.159.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 01:47:19.109874 2026] [security2:error] [pid 14829:tid 14829] [client 201.218.159.154:3606 ...
show more
(mod_security) mod_security (id:210350) triggered by 201.218.159.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 01:47:19.109874 2026] [security2:error] [pid 14829:tid 14829] [client 201.218.159.154:36064] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||michaelgatley.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "michaelgatley.com"] [uri "/"] [unique_id "avAa95d-4ozKWgFhKduDHQAAAAw"], referer: https://web20.space/dir/premium-link-building-135831
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-05-25 01:28:59
UTC ·
(5 months ago)
1779672472.480022 201.218.159.154 103.166.156.58 64240_2-4-8-1-3_1412_7 2026-05-25 08:27:52 WIB
...
Email Spam
Hacking
🇮🇹
VHosting
2025-10-11 14:33:45
UTC ·
(1 year ago)
Detected mail brute force attack from 4 different servers
Brute-Force
2025-09-11 09:26:02
UTC ·
(1 year ago)
...
Web Spam
Web App Attack
2025-09-11 01:38:10
UTC ·
(1 year ago)
201.218.159.154 - - [11/Sep/2025:01:38:02 +0000] "POST /wiki/Special:Contact HTTP/1.1" 200 10958 "https://en.transformal.com/wiki/Special:Contact" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safa ...
show more
201.218.159.154 - - [11/Sep/2025:01:38:02 +0000] "POST /wiki/Special:Contact HTTP/1.1" 200 10958 "https://en.transformal.com/wiki/Special:Contact" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/89.0.4447.51"
201.218.159.154 - - [11/Sep/2025:01:38:09 +0000] "POST /wiki/Special:Contact HTTP/1.1" 200 10653 "https://en.transformal.com/wiki/Special:Contact" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/89.0.4447.51"
...
show less
Web Spam
Web App Attack
🇫🇷
dynamix
2025-08-05 15:29:53
UTC ·
(1 year ago)
Multiple WAF Violations
Web App Attack
🇫🇷
ᴀʀᴛ
2025-07-24 21:15:33
UTC ·
(1 year ago)
Triggered Cloudflare WAF (l7ddos) from PE.
ASN: 271835 (P Y D TELECOM S.R.L.)
Protocol: HTTP/2 (GET method)
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
This report was generated ...
show more
Triggered Cloudflare WAF (l7ddos) from PE.
ASN: 271835 (P Y D TELECOM S.R.L.)
Protocol: HTTP/2 (GET method)
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
DDoS Attack
Bad Web Bot
🇺🇸
xmission.com
2025-07-21 18:59:09
UTC ·
(1 year ago)
Blocked 16 connection attempts due to RBL reputation in the past hour.
Email Spam
🇳🇱
Cloud86 B.V.
2025-07-21 16:15:06
UTC ·
(1 year ago)
Email spam
Email Spam
🇳🇱
globcom
2025-06-15 15:54:28
UTC ·
(1 year ago)
Spam / Spoofing
Email Spam
Spoofing
🇵🇹
rnl
2025-05-23 20:46:28
UTC ·
(1 year ago)
postfix (unknown user, SPF fail or relay access denied)
Brute-Force
🇸🇰
Eurofluid
2025-05-19 18:01:37
UTC ·
(1 year ago)
You shall not pass ! Abusive behavior blocked by EF firewall.
Port Scan
Hacking
Brute-Force
🇳🇱
Cloud86 B.V.
2025-05-13 16:35:24
UTC ·
(1 year ago)
Spam detected in mail logs (subject: 'Betaling van je rekening.')
Email Spam
