🇯🇵
Short-legs-Spider
2026-06-16 08:11:56
(1 week ago)
Disregard of robots.txt
--
[16/Jun/2026:17:11:56 +0900] "GET / HTTP/1.1" 403 76 "-" "Mozilla/5.0 ( ...
show more
Disregard of robots.txt
--
[16/Jun/2026:17:11:56 +0900] "GET / HTTP/1.1" 403 76 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1"
show less
Bad Web Bot
🇩🇪
Admins@FBN
2026-06-15 11:48:33
(1 week ago)
FW-PortScan: Traffic Blocked srcport=59176 dstport=80
Port Scan
🇬🇧
OptimusGO
2026-06-15 10:40:57
(1 week ago)
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Time ...
show more
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Timestamp: 2026-06-15 11:40:57 UTC
Log evidence:
43.134.88.241 - - [15/Jun/2026:11:40:56 +0100] "GET / HTTP/1.1" 200 409 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1"
06/15/2026-11:40:56.512340 [**] [1:2221035:1] SURICATA HTTP Request excessive header repetition [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 43.134.88.241:36562 -> 185.127.18.66:80
show less
Port Scan
Brute-Force
🇺🇸
conrad10781
2026-06-10 08:24:47
(2 weeks ago)
nginx-direct-ip
Port Scan
🇩🇪
big-cloud.nl
2026-06-10 07:24:07
(2 weeks ago)
Try to access /xmlrpc.php
Web App Attack
🇨🇦
1gz
2026-06-10 04:19:24
(2 weeks ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: CHALLENGE
Protocol: HTTP/1.1 (GET m ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇳🇱
soverin
2026-06-10 02:16:12
(2 weeks ago)
Network scan on port 80
Email Spam
🇺🇸
TPI-Abuse
2026-06-10 01:06:19
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 21:06:13.347624 2026] [security2:error] [pid 1400:tid 1400] [client 43.134.88.241:55992] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||campconcerto.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "campconcerto.com"] [uri "/"] [unique_id "aii4hYUy8dlUb1SJJxOpOwAAAAQ"], referer: http://campconcerto.org
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
Progetto1
2026-06-10 00:20:02
(2 weeks ago)
Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 00:07:58
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 20:07:52.908179 2026] [security2:error] [pid 11189:tid 11189] [client 43.134.88.241:57820] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||riverflow.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "riverflow.com"] [uri "/vod"] [unique_id "aiiq2MvNJ_VkVUo8psAcrwAAABs"], referer: http://www.voicesofdemocracy.click
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 22:41:03
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 18:40:55.204336 2026] [security2:error] [pid 19271:tid 19271] [client 43.134.88.241:34602] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.khodel.info|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.khodel.info"] [uri "/"] [unique_id "aiiWdyTub9Bs3CaM8hLSxwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 19:34:03
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 15:33:57.128629 2026] [security2:error] [pid 32093:tid 32093] [client 43.134.88.241:33504] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||giveorcas.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "giveorcas.org"] [uri "/"] [unique_id "aihqpezixs1ijaD-BW2DLQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 19:05:12
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 15:05:03.453887 2026] [security2:error] [pid 16499:tid 16499] [client 43.134.88.241:53784] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.salinabible.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.salinabible.org"] [uri "/"] [unique_id "aihj34pm-ZtoA6oNP-sjHQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 18:25:10
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 14:25:06.259659 2026] [security2:error] [pid 29812:tid 29812] [client 43.134.88.241:51504] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.schoolrx.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.schoolrx.org"] [uri "/"] [unique_id "aihagoISxInAQ44ARfHJ0QAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 18:06:19
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 43.134.88.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 14:06:16.408804 2026] [security2:error] [pid 20831:tid 20831] [client 43.134.88.241:52450] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.virtualvideo.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.virtualvideo.org"] [uri "/"] [unique_id "aihWGKAnhS54iKv80U3RqQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack