🇺🇸
TPI-Abuse
2026-11-07 18:45:08
UTC ·
(54 minutes ago)
(mod_security) mod_security (id:210350) triggered by 45.70.64.106 (45-70-64-106.qualitytelecom.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 13:45:01.982398 2026] [security2:error] [pid 14505:tid 14505 ...
show more
(mod_security) mod_security (id:210350) triggered by 45.70.64.106 (45-70-64-106.qualitytelecom.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 13:45:01.982398 2026] [security2:error] [pid 14505:tid 14505] [client 45.70.64.106:12263] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jbaydeliveries.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jbaydeliveries.com"] [uri "/"] [unique_id "au9xrQVarTYrTcVJmeMQWQAAABE"], referer: https://infojeffreysbay.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
nyuuzyou
2026-11-06 10:36:12
UTC ·
(1 day ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-11-06T10:36:12Z.
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-25 02:03:00
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 45.70.64.106 (45-70-64-106.qualitytelecom.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 22:02:56.079345 2026] [security2:error] [pid 16441:tid 16509 ...
show more
(mod_security) mod_security (id:210350) triggered by 45.70.64.106 (45-70-64-106.qualitytelecom.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 22:02:56.079345 2026] [security2:error] [pid 16441:tid 16509] [client 45.70.64.106:12564] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||garyanddani.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "garyanddani.com"] [uri "/"] [unique_id "at1jUE136X8OuEjmZDLV3wAAAcU"], referer: https://acquire.co.in/redirect.php?ref_host=studioisabellastraga.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-10-01 18:21:28
UTC ·
(1 month ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics[21]=28&topics[22]=89&topics[23]=38&topics[24]=67 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics[21]=28&topics[22]=89&topics[23]=38&topics[24]=67 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
🇺🇸
鬼影233
2026-10-01 07:46:52
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-29 06:47:56
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
2026-09-26 06:17:55
UTC ·
(1 month ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-skip.asp
Exploited Host
Bad Web Bot
🇺🇸
鬼影233
2026-09-24 14:28:09
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-22 07:14:55
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-20 17:41:47
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
🇮🇹
A000Z
2026-09-20 05:42:28
UTC ·
(1 month ago)
Fail2Ban: 45.70.64.106 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-18 16:00:11
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
kosada.com
2026-07-06 21:32:28
UTC ·
(4 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇮🇩
hermawan
2026-04-20 04:21:36
UTC ·
(6 months ago)
[Mon Apr 20 11:21:35.729743 2026] [security2:error] [pid 25607:tid 140173674264256] [client 45.70.64.106:25806] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "image/heif" at REQUEST_HEADERS:Accept. [file "/etc/modsecurity/corerul ...
show more
[Mon Apr 20 11:21:35.729743 2026] [security2:error] [pid 25607:tid 140173674264256] [client 45.70.64.106:25806] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "image/heif" at REQUEST_HEADERS:Accept. [file "/etc/modsecurity/coreruleset-4.25.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "463"] [id "440009"] [msg " Image Heif"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: text/html found within REQUEST_HEADERS:Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/heif,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 request_line = GET /index.php/informasi-iklim/infografis-iklim/infografis-dasarian/infografis-dasarian-iklim HTTP/2.0 Request URI RAW = /index.php/informasi-iklim/infografis-iklim/infografis-dasarian/infografi..."] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/informasi-iklim/infografis-iklim/infografis-dasarian/infografis-dasa
...
show less
Email Spam
Hacking
2025-11-21 00:59:17
UTC ·
(11 months ago)
scanning http requests from known botnet
Web App Attack
