🇺🇸
TPI-Abuse
2026-05-31 14:18:53
(5 days ago)
(mod_security) mod_security (id:217210) triggered by 37.235.49.104 (104-49-235-37.static.edis.at): 1 ...
show more
(mod_security) mod_security (id:217210) triggered by 37.235.49.104 (104-49-235-37.static.edis.at): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 10:18:46.865755 2026] [security2:error] [pid 6947:tid 6947] [client 37.235.49.104:30684] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||haverhillhouse.com:443|F|4"] [data "CONNECT haverhillhouse.com:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "haverhillhouse.com"] [uri "/"] [unique_id "ahxDRo3av5aAXqNawLEOagAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-30 23:26:35
(5 days ago)
(mod_security) mod_security (id:217210) triggered by 37.235.49.104 (104-49-235-37.static.edis.at): 1 ...
show more
(mod_security) mod_security (id:217210) triggered by 37.235.49.104 (104-49-235-37.static.edis.at): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 30 19:26:30.572118 2026] [security2:error] [pid 28579:tid 28579] [client 37.235.49.104:35946] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||bodiehistory.com:443|F|4"] [data "CONNECT bodiehistory.com:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bodiehistory.com"] [uri "/"] [unique_id "ahtyJo29ZLePs1rzh9o_igAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xmission.com
2026-05-30 01:51:13
(6 days ago)
37.235.49.104 - - [29/May/2026:17:41:44 -0600] "CONNECT dooce.com:443 HTTP/1.1" 400 150 "-" "-"
37.2 ...
show more
37.235.49.104 - - [29/May/2026:17:41:44 -0600] "CONNECT dooce.com:443 HTTP/1.1" 400 150 "-" "-"
37.235.49.104 - - [29/May/2026:17:52:51 -0600] "CONNECT dooce.com:443 HTTP/1.1" 400 150 "-" "-"
37.235.49.104 - - [29/May/2026:18:37:45 -0600] "CONNECT dooce.com:443 HTTP/1.1" 400 150 "-" "-"
37.235.49.104 - - [29/May/2026:19:03:04 -0600] "CONNECT dooce.com:443 HTTP/1.1" 400 150 "-" "-"
37.235.49.104 - - [29/May/2026:19:51:13 -0600] "CONNECT dooce.com:443 HTTP/1.1" 400 150 "-" "-"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-28 04:22:15
(1 week ago)
(mod_security) mod_security (id:217210) triggered by 37.235.49.104 (104-49-235-37.static.edis.at): 1 ...
show more
(mod_security) mod_security (id:217210) triggered by 37.235.49.104 (104-49-235-37.static.edis.at): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 00:22:09.021313 2026] [security2:error] [pid 23886:tid 23942] [client 37.235.49.104:43554] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||whatismetamodern.com:443|F|4"] [data "CONNECT whatismetamodern.com:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "whatismetamodern.com"] [uri "/"] [unique_id "ahfC8TfXoUdn1LIp0MUwlAAAAVc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
Origon
2026-05-28 03:43:48
(1 week ago)
http-open-proxy - IP: 37.235.49.104 - time="2026-05-28T05:43:48+02:00" level=info msg="(555f66b4f6a ...
show more
http-open-proxy - IP: 37.235.49.104 - time="2026-05-28T05:43:48+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-open-proxy by ip 37.235.49.104 (IS/50613) : 4h ban on Ip 37.235.49.104" module=db
show less
Web App Attack
🇩🇪
Ivan Rezinkin
2026-05-25 12:22:17
(1 week ago)
DDoS attack against sub.cocooloco.ru (181.214.231.116) - L7 connection flood, observed sustained SYN ...
show more
DDoS attack against sub.cocooloco.ru (181.214.231.116) - L7 connection flood, observed sustained SYN traffic causing TCP listen-queue overflow. Auto-banned at 5/sec threshold via iptables hashlimit. Timestamp: 2026-05-25T12:21:02Z
show less
DDoS Attack
Email Spam
🇩🇪
ghostwarriors
2026-05-20 22:20:21
(2 weeks ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-14 20:41:11
(3 weeks ago)
(mod_security) mod_security (id:217210) triggered by 37.235.49.104 (104-49-235-37.static.edis.at): 1 ...
show more
(mod_security) mod_security (id:217210) triggered by 37.235.49.104 (104-49-235-37.static.edis.at): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 16:41:05.743794 2026] [security2:error] [pid 17542:tid 17542] [client 37.235.49.104:15128] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||bobfaw.com:443|F|4"] [data "CONNECT bobfaw.com:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bobfaw.com"] [uri "/"] [unique_id "agYzYYEmWftFLp9FSPaLZgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack