37.238.4.144

block ruleset 6B63410D189E6343B910F7440B8499558BEC52EB

HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 3 requests from 2026-11-09T09:35:33+00:00 to 2026-11-10T22:56:41+00:00, e.g. 'GET /en/bbe,darby,esv/gen/39/22 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; ... show more HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 3 requests from 2026-11-09T09:35:33+00:00 to 2026-11-10T22:56:41+00:00, e.g. 'GET /en/bbe,darby,esv/gen/39/22 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested). show less

Login Too Frequent (7)

VM1 Bad user agents ignoring web crawling rules. Draing bandwidth

Suspicious WooCommerce query combination detected. Not default available on websites. Matched combi patterns: filter_, add-to-cart=, orderby=, product_count=. Activity is consistent with high-volume request abuse.

Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-post.asp

Scanning for port/service exploits on tpc-012.mach3builders.nl

Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -51.271 (Bad < -10 / Very Bad < -20 / Extreme < -35) | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0

Fail2Ban: 37.238.4.144 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36

(mod_security) mod_security (id:210730) triggered by 37.238.4.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 10:00:27.357705 2026] [security2:error] [pid 183118:tid 183118] [client 37.238.4.144:55322] M ... show more (mod_security) mod_security (id:210730) triggered by 37.238.4.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 10:00:27.357705 2026] [security2:error] [pid 183118:tid 183118] [client 37.238.4.144:55322] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||internet-brochures.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "internet-brochures.com"] [uri "/dynamicdancecenter.com"] [unique_id "adZfe0UVo_5Abi0bzrP08wAAAAY"], referer: http://internet-brochures.com/ show less

Detected attack and reported by a human

Web App Attack

Web App Attack

Connection atttempts against closed TCP ports Nov 20 13:35:47 BLOCK SRC=37.238.4.144 LEN=52 TOS=0x00 PREC=0x00 TTL=43 ID=28526 DF PROTO=TCP SPT=35781 DPT=443 WINDOW=32044 RES=0x00 ACK FIN Nov 20 13:35:54 BLOCK SRC=37.238.4.144 LEN=52 TOS=0x00 PREC=0 ... show more Connection atttempts against closed TCP ports Nov 20 13:35:47 BLOCK SRC=37.238.4.144 LEN=52 TOS=0x00 PREC=0x00 TTL=43 ID=28526 DF PROTO=TCP SPT=35781 DPT=443 WINDOW=32044 RES=0x00 ACK FIN Nov 20 13:35:54 BLOCK SRC=37.238.4.144 LEN=52 TOS=0x00 PREC=0x00 TTL=43 ID=28527 DF PROTO=TCP SPT=35781 DPT=443 WINDOW=32044 RES=0x00 ACK FIN Nov 20 13:36:31 BLOCK SRC=37.238.4.144 LEN=52 TOS=0x00 PREC=0x00 TTL=43 ID=28529 DF PROTO=TCP SPT=35781 DPT=443 WINDOW=32044 RES=0x00 ACK FIN show less

scanning http requests from known botnet