🇺🇸
TPI-Abuse
2026-10-01 01:44:53
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 45.166.154.126 (126-154-166-45.brandaotelecom.n ...
show more
(mod_security) mod_security (id:210350) triggered by 45.166.154.126 (126-154-166-45.brandaotelecom.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 21:44:49.133091 2026] [security2:error] [pid 18692:tid 18692] [client 45.166.154.126:55941] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||eefinchco.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "eefinchco.com"] [uri "/"] [unique_id "ar27EZsxMAyPTCuRFrwDwgAAAA4"], referer: https://websitelinkgenerator.website/dir/seo-growth-backlinks-62326
show less
Brute-Force
Bad Web Bot
Web App Attack
🇻🇳
trung.fun
2026-08-21 01:47:08
(2 months ago)
DDoS, Hack, Brute Force, Web Attack
...
DDoS Attack
Web Spam
Hacking
Brute-Force
Web App Attack
🇺🇸
kosada.com
2026-08-18 05:42:45
(2 months ago)
Web bot: DDoS
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-17 07:08:22
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 45.166.154.126 (126-154-166-45.brandaotelecom.n ...
show more
(mod_security) mod_security (id:210730) triggered by 45.166.154.126 (126-154-166-45.brandaotelecom.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 03:08:17.199336 2026] [security2:error] [pid 13105:tid 13105] [client 45.166.154.126:36610] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||med-engineering.com|F|2"] [data ".fildena.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "med-engineering.com"] [uri "/www.fildena.com"] [unique_id "aoKzYXfF31gcQylXQQYGSgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-07-26 23:18:16
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
2026-07-11 09:28:20
(3 months ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show more
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in email-link.asp
show less
Exploited Host
Bad Web Bot
🇺🇸
kosada.com
2026-07-06 07:34:04
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
2026-03-31 03:18:54
(6 months ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
🇮🇹
A000Z
2026-03-21 18:43:03
(7 months ago)
Fail2Ban: 45.166.154.126 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5 ...
show more
Fail2Ban: 45.166.154.126 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
show less
Bad Web Bot
🇮🇹
VHosting
2025-12-23 17:40:15
(9 months ago)
Detected attack and reported by a human
DDoS Attack
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
2025-11-15 05:31:17
(11 months ago)
scanning http requests from known botnet
Web App Attack
2025-10-14 18:06:57
(1 year ago)
Web Probe / Attack
Web App Attack
🇺🇸
TPI-Abuse
2025-10-13 16:33:09
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 45.166.154.126 (126-154-166-45.brandaotelecom.n ...
show more
(mod_security) mod_security (id:225170) triggered by 45.166.154.126 (126-154-166-45.brandaotelecom.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 13 12:33:04.710014 2025] [security2:error] [pid 25097:tid 25097] [client 45.166.154.126:36012] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||aquanauticsige.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aquanauticsige.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aO0pwOF16JP8Xi9fLstMkQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
kjaerulff
2025-10-13 06:51:05
(1 year ago)
Failed Wordpress login using xmlrpc.php (126-154-166-45.brandaotelecom.net.br)
Web App Attack
🇳🇱
ParaBug
2025-10-13 01:58:30
(1 year ago)
45.166.154.126 - - [13/Oct/2025:03:58:30 +0200] "POST /xmlrpc.php HTTP/1.1" 301 3331 "-" "Mozilla/5. ...
show more
45.166.154.126 - - [13/Oct/2025:03:58:30 +0200] "POST /xmlrpc.php HTTP/1.1" 301 3331 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
...
show less
Phishing
Brute-Force
Web App Attack