🇺🇸
43.135.185.59
15 May 2025
(mod_security) mod_security (id:210350) triggered by 43.135.185.59 (US/United States/California/Sant ...
show more
(mod_security) mod_security (id:210350) triggered by 43.135.185.59 (US/United States/California/Santa Clara/-/[AS132203 Tencent Building, Kejizhongyi Avenue]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu May 15 02:36:27.439319 2025] [:error] [pid 1374772:tid 1374776] [client 43.135.185.59:33246] [client 43.135.185.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||216.244.65.67:80|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "216.244.65.67"] [uri "/"] [unique_id "aCWLa4l8AYdcA6h_j5ZsTgAAAME"]
show less
Port Scan
🇺🇸
174.138.40.30
15 May 2025
(bind) bind triggered by 174.138.40.30 (US/United States/New Jersey/North Bergen/open-resolver-scan. ...
show more
(bind) bind triggered by 174.138.40.30 (US/United States/New Jersey/North Bergen/open-resolver-scan.proper.com/[AS14061 DIGITALOCEAN-ASN]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May 15 01:49:18 derek named[1023]: client @0x7f9100118390 174.138.40.30#43913 (1747288158.D8F44144.2025-05-15-00-01-NXD.open-resolver-scan.research.icann.org): query (cache) '1747288158.D8F44144.2025-05-15-00-01-NXD.open-resolver-scan.research.icann.org/TXT/IN' denied
show less
Port Scan
🇺🇸
67.10.181.137
15 May 2025
(PERMBLOCK) 67.10.181.137 (US/United States/Texas/San Antonio/syn-067-010-181-137.res.spectrum.com/[ ...
show more
(PERMBLOCK) 67.10.181.137 (US/United States/Texas/San Antonio/syn-067-010-181-137.res.spectrum.com/[AS11427 TWC-11427-TEXAS]) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:
show less
Port Scan
🇺🇸
174.138.40.30
15 May 2025
(bind) bind triggered by 174.138.40.30 (US/United States/New Jersey/North Bergen/open-resolver-scan. ...
show more
(bind) bind triggered by 174.138.40.30 (US/United States/New Jersey/North Bergen/open-resolver-scan.proper.com/[AS14061 DIGITALOCEAN-ASN]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May 14 23:32:18 derek named[1023]: client @0x7f91000dcff0 174.138.40.30#43913 (1747279938.D8F44143.2025-05-15-00-01-NXD.open-resolver-scan.research.icann.org): query (cache) '1747279938.D8F44143.2025-05-15-00-01-NXD.open-resolver-scan.research.icann.org/TXT/IN' denied
show less
Port Scan
🇺🇸
198.98.58.108
15 May 2025
(bind) bind triggered by 198.98.58.108 (US/United States/New York/Staten Island/-/[AS53667 PONYNET]) ...
show more
(bind) bind triggered by 198.98.58.108 (US/United States/New York/Staten Island/-/[AS53667 PONYNET]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May 14 20:41:59 derek named[1023]: client @0x7f91000fabb0 198.98.58.108#39310 (collectd.org): query (cache) 'collectd.org/ANY/IN' denied
show less
Port Scan
🇺🇸
43.135.138.128
15 May 2025
(mod_security) mod_security (id:210350) triggered by 43.135.138.128 (US/United States/California/San ...
show more
(mod_security) mod_security (id:210350) triggered by 43.135.138.128 (US/United States/California/Santa Clara/-/[AS132203 Tencent Building, Kejizhongyi Avenue]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed May 14 20:18:43.862425 2025] [:error] [pid 1374772:tid 1374799] [client 43.135.138.128:34130] [client 43.135.138.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||216.244.65.67|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "216.244.65.67"] [uri "/"] [unique_id "aCUy44l8AYdcA6h_j5ZrOAAAANg"]
show less
Port Scan
🇺🇸
50.190.93.230
14 May 2025
(PERMBLOCK) 50.190.93.230 (US/United States/Colorado/Denver/c-50-190-93-230.unallocated.comcastbusin ...
show more
(PERMBLOCK) 50.190.93.230 (US/United States/Colorado/Denver/c-50-190-93-230.unallocated.comcastbusiness.net/[AS7922 COMCAST-7922]) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:
show less
Port Scan
🇺🇸
208.109.214.237
14 May 2025
(PERMBLOCK) 208.109.214.237 (US/United States/-/-/237.214.109.208.host.secureserver.net/[AS398101 GO ...
show more
(PERMBLOCK) 208.109.214.237 (US/United States/-/-/237.214.109.208.host.secureserver.net/[AS398101 GO-DADDY-COM-LLC]) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:
show less
Port Scan
🇺🇸
43.153.36.110
14 May 2025
(mod_security) mod_security (id:210350) triggered by 43.153.36.110 (US/United States/California/Sant ...
show more
(mod_security) mod_security (id:210350) triggered by 43.153.36.110 (US/United States/California/Santa Clara/-/[AS132203 Tencent Building, Kejizhongyi Avenue]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed May 14 13:14:18.043309 2025] [:error] [pid 1374772:tid 1374789] [client 43.153.36.110:32804] [client 43.153.36.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||216.244.65.67|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "216.244.65.67"] [uri "/"] [unique_id "aCTPaol8AYdcA6h_j5ZqIwAAAM4"]
show less
Port Scan
🇺🇸
170.106.148.137
14 May 2025
(mod_security) mod_security (id:210350) triggered by 170.106.148.137 (US/United States/California/Sa ...
show more
(mod_security) mod_security (id:210350) triggered by 170.106.148.137 (US/United States/California/Santa Clara/-/[AS132203 Tencent Building, Kejizhongyi Avenue]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed May 14 12:25:22.519456 2025] [:error] [pid 1374381:tid 1374431] [client 170.106.148.137:53216] [client 170.106.148.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||216.244.65.67:80|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "216.244.65.67"] [uri "/"] [unique_id "aCTD8kbxbc-eZ18v8m9oBgAAAFE"]
show less
Port Scan
🇺🇸
12.179.121.6
14 May 2025
(PERMBLOCK) 12.179.121.6 (US/United States/Arkansas/Cabot/-/[AS7018 ATT-INTERNET4]) has had more tha ...
show more
(PERMBLOCK) 12.179.121.6 (US/United States/Arkansas/Cabot/-/[AS7018 ATT-INTERNET4]) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:
show less
Port Scan
🇺🇸
43.166.226.186
14 May 2025
(mod_security) mod_security (id:210350) triggered by 43.166.226.186 (US/United States/Virginia/Ashbu ...
show more
(mod_security) mod_security (id:210350) triggered by 43.166.226.186 (US/United States/Virginia/Ashburn/-/[AS132203 Tencent Building, Kejizhongyi Avenue]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue May 13 23:52:44.997944 2025] [:error] [pid 1328819:tid 1328847] [client 43.166.226.186:58744] [client 43.166.226.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||216.244.65.67|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "216.244.65.67"] [uri "/"] [unique_id "aCQTjAY0OB-67V1nKt4hxgAAAIk"]
show less
Port Scan
🇺🇸
43.166.128.187
14 May 2025
(mod_security) mod_security (id:210350) triggered by 43.166.128.187 (US/United States/Virginia/Ashbu ...
show more
(mod_security) mod_security (id:210350) triggered by 43.166.128.187 (US/United States/Virginia/Ashburn/-/[AS132203 Tencent Building, Kejizhongyi Avenue]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue May 13 22:55:14.060449 2025] [:error] [pid 1328817:tid 1328829] [client 43.166.128.187:51506] [client 43.166.128.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||216.244.65.67:80|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "216.244.65.67"] [uri "/"] [unique_id "aCQGEqM9tqePHVcCgT6bPgAAAAc"]
show less
Port Scan
🇺🇸
68.183.137.128
14 May 2025
(bind) bind triggered by 68.183.137.128 (US/United States/New Jersey/North Bergen/portscanner-nyc1-0 ...
show more
(bind) bind triggered by 68.183.137.128 (US/United States/New Jersey/North Bergen/portscanner-nyc1-01.prod.cyberresilience.io/[AS14061 DIGITALOCEAN-ASN]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May 13 21:45:06 derek named[1023]: client @0x7f91000dcff0 68.183.137.128#53 (cyberresilience.io): query (cache) 'cyberresilience.io/A/IN' denied
show less
Port Scan
🇺🇸
38.58.182.159
13 May 2025
(bind) bind triggered by 38.58.182.159 (US/United States/Utah/Draper/-/[AS26042 FIBERSTATE]): 1 in t ...
show more
(bind) bind triggered by 38.58.182.159 (US/United States/Utah/Draper/-/[AS26042 FIBERSTATE]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May 13 15:24:23 derek named[1023]: client @0x7f9100118390 38.58.182.159#17934 (sl): query (cache) 'sl/ANY/IN' denied
show less
Port Scan
🇺🇸
216.147.95.135
13 May 2025
(XMLRPC) WP XMLPRC Attack 216.147.95.135 (US/United States/Georgia/Eatonton/-/[AS399673 TRI-COGO]): ...
show more
(XMLRPC) WP XMLPRC Attack 216.147.95.135 (US/United States/Georgia/Eatonton/-/[AS399673 TRI-COGO]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 216.147.95.135 - - [13/May/2025:12:57:33 -0400] "POST /xmlrpc.php HTTP/1.1" 404 16 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
show less
Port Scan
🇺🇸
38.110.46.247
13 May 2025
(bind) bind triggered by 38.110.46.247 (US/United States/Georgia/Atlanta/researchscan247.cc.gatech.e ...
show more
(bind) bind triggered by 38.110.46.247 (US/United States/Georgia/Atlanta/researchscan247.cc.gatech.edu/[AS2637 GEORGIA-TECH]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May 13 11:53:02 derek named[1023]: client @0x7f9100118390 38.110.46.247#55404 (4810608ab6b5969f2df720f90736f21803e09d.ipv6scanning.com): query (cache) '4810608ab6b5969f2df720f90736f21803e09d.ipv6scanning.com/A/IN' denied
show less
Port Scan
🇺🇸
107.151.208.210
13 May 2025
(XMLRPC) WP XMLPRC Attack 107.151.208.210 (US/United States/-/-/-/[AS62610 ZEN-DPS]): 1 in the last ...
show more
(XMLRPC) WP XMLPRC Attack 107.151.208.210 (US/United States/-/-/-/[AS62610 ZEN-DPS]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 107.151.208.210 - - [13/May/2025:09:12:17 -0400] "GET /xmlrpc.php?rsd HTTP/1.1" 404 16 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
show less
Port Scan
🇺🇸
43.166.226.186
13 May 2025
(mod_security) mod_security (id:210350) triggered by 43.166.226.186 (US/United States/Virginia/Ashbu ...
show more
(mod_security) mod_security (id:210350) triggered by 43.166.226.186 (US/United States/Virginia/Ashburn/-/[AS132203 Tencent Building, Kejizhongyi Avenue]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue May 13 09:07:01.151673 2025] [:error] [pid 1328819:tid 1328834] [client 43.166.226.186:45742] [client 43.166.226.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||216.244.65.67|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "216.244.65.67"] [uri "/"] [unique_id "aCND9QY0OB-67V1nKt4fqgAAAIA"]
show less
Port Scan
🇺🇸
198.98.58.108
13 May 2025
(bind) bind triggered by 198.98.58.108 (US/United States/New York/Staten Island/-/[AS53667 PONYNET]) ...
show more
(bind) bind triggered by 198.98.58.108 (US/United States/New York/Staten Island/-/[AS53667 PONYNET]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May 13 08:51:54 derek named[1023]: client @0x7f91000ce570 198.98.58.108#34757 (collectd.org): query (cache) 'collectd.org/ANY/IN' denied
show less
Port Scan
🇺🇸
45.152.86.87
13 May 2025
(bind) bind triggered by 45.152.86.87 (US/United States/California/Fremont/-/[AS56971 Cgi Global Lim ...
show more
(bind) bind triggered by 45.152.86.87 (US/United States/California/Fremont/-/[AS56971 Cgi Global Limited]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May 13 08:18:13 derek named[1023]: client @0x7f91000bfaf0 45.152.86.87#34331 (sl): query (cache) 'sl/ANY/IN' denied
show less
Port Scan
🇺🇸
205.185.124.52
13 May 2025
(bind) bind triggered by 205.185.124.52 (US/United States/Nevada/Las Vegas/mx27.gomytimmy.com/[AS536 ...
show more
(bind) bind triggered by 205.185.124.52 (US/United States/Nevada/Las Vegas/mx27.gomytimmy.com/[AS53667 PONYNET]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May 13 08:06:11 derek named[1023]: client @0x7f91001097a0 205.185.124.52#41941 (sl): query (cache) 'sl/ANY/IN' denied
show less
Port Scan
🇺🇸
198.199.67.247
13 May 2025
(bind) bind triggered by 198.199.67.247 (US/United States/New Jersey/North Bergen/-/[AS14061 DIGITAL ...
show more
(bind) bind triggered by 198.199.67.247 (US/United States/New Jersey/North Bergen/-/[AS14061 DIGITALOCEAN-ASN]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May 13 07:34:06 derek named[1023]: client @0x7f9100118390 198.199.67.247#55581 (xyz.example.org): query (cache) 'xyz.example.org/A/IN' denied
show less
Port Scan
🇺🇸
24.199.99.237
13 May 2025
(bind) bind triggered by 24.199.99.237 (US/United States/California/Santa Clara/-/[AS14061 DIGITALOC ...
show more
(bind) bind triggered by 24.199.99.237 (US/United States/California/Santa Clara/-/[AS14061 DIGITALOCEAN-ASN]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May 13 07:19:00 derek named[1023]: client @0x7f91000bfaf0 24.199.99.237#38932 (sl): query (cache) 'sl/ANY/IN' denied
show less
Port Scan
🇺🇸
216.218.206.69
13 May 2025
(mod_security) mod_security (id:210492) triggered by 216.218.206.69 (US/United States/California/Caz ...
show more
(mod_security) mod_security (id:210492) triggered by 216.218.206.69 (US/United States/California/Cazadero/69.64-26.206.218.216.in-addr.arpa/[AS6939 HURRICANE]): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue May 13 02:59:57.607744 2025] [:error] [pid 1287413:tid 1287431] [client 216.218.206.69:5982] [client 216.218.206.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "216.244.65.67"] [uri "/.git/config"] [unique_id "aCLt7bXWNPO4BVsb-Gh4CgAAANA"]
show less
Port Scan