🇺🇸
TPI-Abuse
2026-10-26 03:00:31
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 38.210.202.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 23:00:25.904047 2026] [security2:error] [pid 32405:tid 32405] [client 38.210.202.123:45054] ...
show more
(mod_security) mod_security (id:210350) triggered by 38.210.202.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 23:00:25.904047 2026] [security2:error] [pid 32405:tid 32405] [client 38.210.202.123:45054] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||cbcfargo.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cbcfargo.com"] [uri "/resources/promise/true_joy.pdf"] [unique_id "at7CSaSPHMyVupsAX64akwAAABQ"], referer: https://cbcfargo.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 16:58:16
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 38.210.202.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 12:58:10.045292 2026] [security2:error] [pid 28369:tid 28369] [client 38.210.202.123:52722] ...
show more
(mod_security) mod_security (id:210350) triggered by 38.210.202.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 12:58:10.045292 2026] [security2:error] [pid 28369:tid 28369] [client 38.210.202.123:52722] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||mhext.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "mhext.com"] [uri "/"] [unique_id "at41ItxivqFIWXqHZHOoBQAAAAI"], referer: https://sitelike.org/similar/leewillett.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-11 18:37:08
UTC ·
(2 months ago)
denied traffic to a honeypot network. destination port 58666.
Port Scan
Hacking
🇹🇷
neron
2026-08-19 14:26:20
UTC ·
(2 months ago)
CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall
Hacking
Web App Attack
🇬🇧
djboddington
2026-06-01 15:18:04
UTC ·
(5 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-cve-2021-41773
Web App Attack
Hacking
🇹🇭
Sawasdee
2026-06-01 05:42:10
UTC ·
(5 months ago)
Unwanted checking 80 or 443 port
...
Bad Web Bot
🇧🇷
SOC PR
2026-06-01 04:12:35
UTC ·
(5 months ago)
IPS: PHP CGI Argument Injection (CVE-2024-4577).
Web App Attack
🇩🇪
guldkage
2026-06-01 01:35:23
UTC ·
(5 months ago)
Unauthorized connection attempt detected from IP address 38.210.202.123 to port 23 (ger-03) [q]
Brute-Force
Exploited Host
🇳🇱
Alboweb B.V.
2026-05-31 21:11:49
UTC ·
(5 months ago)
SSH abuse or brute-force attack detected by Fail2Ban in ssh jail
Brute-Force
SSH
🇸🇪
adaml1324
2026-05-31 17:52:10
UTC ·
(5 months ago)
Web application exploit probing
From server logs:
2026-05-31 15:16:06 (direkt-IP) POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://inpu [444 Blockerad]
UA: libredtail-http
Web App Attack
🇺🇸
bigscoots.com
2026-05-30 19:30:02
UTC ·
(5 months ago)
38.210.202.123 (MX/Mexico/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: May 30 14:20:31 14238 sshd[23450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 eui ...
show more
38.210.202.123 (MX/Mexico/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: May 30 14:20:31 14238 sshd[23450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.210.202.114 user=root
May 30 14:20:32 14238 sshd[23450]: Failed password for root from 38.210.202.114 port 38810 ssh2
May 30 14:25:16 14238 sshd[26269]: Failed password for root from 38.210.202.123 port 57318 ssh2
May 30 14:29:44 14238 sshd[28718]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.210.202.123 user=root
May 30 14:25:14 14238 sshd[26269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.210.202.123 user=root
IP Addresses Blocked:
38.210.202.114 (MX/Mexico/-)
show less
Brute-Force
SSH
🇺🇸
MPL
2026-05-30 17:15:06
UTC ·
(5 months ago)
tcp/80 (4 or more attempts)
Port Scan
🇺🇸
RAP
2026-05-30 12:49:40
UTC ·
(5 months ago)
Probing web services for vulnerabilities
Port Scan
🇦🇺
dyln
2026-05-30 00:30:45
UTC ·
(5 months ago)
Dyls honeypot brute-force: proto8 (2 total hits)
Brute-Force
🇸🇪
sa0azs
2026-05-29 20:25:32
UTC ·
(5 months ago)
May 29 22:20:57 OakCottage sshd[20236]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.210.202.123
May 29 22:20:59 OakCottage sshd[20236]: Failed password for invalid user test from 38.210.202.123 port 582 ...
show more
May 29 22:20:57 OakCottage sshd[20236]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.210.202.123
May 29 22:20:59 OakCottage sshd[20236]: Failed password for invalid user test from 38.210.202.123 port 58206 ssh2
May 29 22:25:29 OakCottage sshd[20354]: Invalid user user from 38.210.202.123 port 38316
...
show less
Brute-Force
SSH
