2026-10-16 06:15:14
(12 hours ago)
Illegitimate and/or suspicious requests.
Hacking
🇺🇸
TPI-Abuse
2026-10-16 04:56:11
(14 hours ago)
(mod_security) mod_security (id:210350) triggered by 49.232.88.176 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 49.232.88.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 00:56:05.227654 2026] [security2:error] [pid 1596:tid 1596] [client 49.232.88.176:37068] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.puckerbikinis.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.puckerbikinis.com"] [uri "/"] [unique_id "atGuZcevv-6thw9F5svKUgAAAHk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
Progetto1
2026-10-16 04:00:05
(14 hours ago)
Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
Charlesiv
2026-10-16 02:10:50
(16 hours ago)
Triggered Cloudflare WAF (firewallCustom) from CN.
Action taken: BLOCK
ASN: 45090 (Shenzhen Tencent ...
show more
Triggered Cloudflare WAF (firewallCustom) from CN.
Action taken: BLOCK
ASN: 45090 (Shenzhen Tencent Computer Systems Company Limited)
Protocol: HTTP/1.1 (GET method)
Endpoint: /
Timestamp: 2026-10-16T01:32:26Z
Ray ID: a4b34f4bfcd61c8c
UA: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1
show less
Bad Web Bot
🇺🇸
HamSammich
2026-10-15 23:24:40
(19 hours ago)
Automated sensor: 2 HTTP connection/probe attempts over the last 24h (latest 2026-10-15T23:24Z).
Brute-Force
Web App Attack
🇩🇪
sdos.es
2026-10-15 15:52:33
(1 day ago)
"Multiple/Conflicting Connection Header Data Found - keep-alive, close"
Web App Attack
🇺🇸
johnkarlhill
2026-10-15 11:16:05
(1 day ago)
WebKnight blocked malicious web request on johnkarlhill.com
Brute-Force
SSH
2026-10-15 09:25:00
(1 day ago)
FortiWeb WAF: 48 attacks detected. Threat Score: 5400. Types: Client Management(24), GEO IP(24). Ori ...
show more
FortiWeb WAF: 48 attacks detected. Threat Score: 5400. Types: Client Management(24), GEO IP(24). Origin: China.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 03:47:34
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 49.232.88.176 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 49.232.88.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 23:47:30.934015 2026] [security2:error] [pid 30616:tid 30616] [client 49.232.88.176:36970] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||al-harbi.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "al-harbi.com"] [uri "/"] [unique_id "atBM0jHhcvF4uJPowX28zwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-10-15 02:05:39
(1 day ago)
Request Overload (106)
Brute-Force
Web App Attack
🇸🇪
SkyDancer
2026-10-14 18:25:44
(2 days ago)
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by Sk ...
show more
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by SkyDancer Ai. EXT-SYS-Vx
show less
Hacking
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-10-14 16:13:35
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 49.232.88.176 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 49.232.88.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 12:13:30.639969 2026] [security2:error] [pid 8277:tid 8277] [client 49.232.88.176:46090] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ardath.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ardath.net"] [uri "/"] [unique_id "as-qKiPVpbk3wBr6WJ1hMQAAAEI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 15:52:04
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 49.232.88.176 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 49.232.88.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 11:51:59.063835 2026] [security2:error] [pid 3570:tid 3570] [client 49.232.88.176:40850] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bienvista.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bienvista.com"] [uri "/"] [unique_id "as-lH36gNHKZDupvB5EpHwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-14 10:41:27
(2 days ago)
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (iPhone; CPU ...
show more
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 S | 2026-10-14 10:41 UTC
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-14 10:16:10
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 49.232.88.176 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 49.232.88.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 06:16:04.025840 2026] [security2:error] [pid 12830:tid 12830] [client 49.232.88.176:33226] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.froemel.biz|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.froemel.biz"] [uri "/"] [unique_id "as9WZKXOr9kfKUYrNj68RAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack