🇹🇷
Domainhizmetleri.com
2026-10-28 02:28:04
(6 days ago)
Source: DH Hunter (Honeypot) | Reason: Unknown Protocol Probe (25/tcp)
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-10-25 23:17:20
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 102.216.85.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 19:17:13.801929 2026] [security2:error] [pid 27123:tid 27123] [client 102.216.85.27:59296] M ...
show more
(mod_security) mod_security (id:210350) triggered by 102.216.85.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 19:17:13.801929 2026] [security2:error] [pid 27123:tid 27123] [client 102.216.85.27:59296] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||buyperfumeonline.net|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "buyperfumeonline.net"] [uri "/"] [unique_id "at6N-efyz5tQPPGDXUpMPAAAABw"], referer: https://bkwsukorealims.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
bart@
2026-10-19 14:33:31
(2 weeks ago)
Automated scan detection against redacted protected targets. Hits=1; port 22 proto 6 detection dark_ip
Port Scan
🇮🇹
RaffOne
2026-10-19 13:54:13
(2 weeks ago)
SSH - Attempt to login using invalid or illegal credential
Brute-Force
SSH
🇫🇷
LRob
2026-10-19 13:28:36
(2 weeks ago)
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
xmission.com
2026-10-19 09:27:55
(2 weeks ago)
Blocked by UFW (TCP on 22)
Source port: 44313
TTL: 44
Packet length: 60
TOS: 0x00
This report (for 102.216.85.27) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
SSH
Brute-Force
🇷🇸
Smel
2026-10-19 05:17:01
(2 weeks ago)
SSH/22 MH Probe, BF, Hack -
Hacking
Brute-Force
SSH
🇺🇸
kosada.com
2026-10-09 10:35:40
(3 weeks ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics[127]=50&topics[128]=68&topics[129]=36&topics[130]=63 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (K ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics[127]=50&topics[128]=68&topics[129]=36&topics[130]=63 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
🇩🇪
LRob
2026-10-09 08:31:49
(3 weeks ago)
Shop search flood (L7 DDoS) | path: /30-meilleur-velo-entre-2000-et-3000-euros | query: order=product.sales.desc&q=Taille-XL-XXL/Marque-Winora | src_port: 49308
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 13:06:42
(4 weeks ago)
(mod_security) mod_security (id:210350) triggered by 102.216.85.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 09:06:38.743650 2026] [security2:error] [pid 19282:tid 19282] [client 102.216.85.27:47352] M ...
show more
(mod_security) mod_security (id:210350) triggered by 102.216.85.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 09:06:38.743650 2026] [security2:error] [pid 19282:tid 19282] [client 102.216.85.27:47352] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||robertmcatee.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "robertmcatee.com"] [uri "/"] [unique_id "asOg3l_93HjKq-etAnkpwAAAABc"], referer: https://buyhighquality.shop/dir/ranking-boost-backlinks-177737
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-15 10:53:52
(3 months ago)
(mod_security) mod_security (id:210740) triggered by 102.216.85.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 06:53:48.790706 2026] [security2:error] [pid 2342797:tid 2342797] [client 102.216.85.27:5377 ...
show more
(mod_security) mod_security (id:210740) triggered by 102.216.85.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 06:53:48.790706 2026] [security2:error] [pid 2342797:tid 2342797] [client 102.216.85.27:53775] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy||www.sparler.com|F|4"] [data "/Proxy-Connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "www.sparler.com"] [uri "/about"] [unique_id "aldmvC721XL25_Ky9hpvmAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
vtchost.com
2026-07-09 04:48:19
(3 months ago)
minux.cc:80 102.216.85.27 - - [09/Jul/2026:06:48:18 +0200] "GET http://minux.cc/wiki/index.php?title=Special:CiteThisPage&page=Main_Page&id=821&wpFormIdentifier=titleform HTTP/1.1" 418 215 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWeb ...
show more
minux.cc:80 102.216.85.27 - - [09/Jul/2026:06:48:18 +0200] "GET http://minux.cc/wiki/index.php?title=Special:CiteThisPage&page=Main_Page&id=821&wpFormIdentifier=titleform HTTP/1.1" 418 215 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
stechusa
2026-07-02 17:23:49
(4 months ago)
ELEVATED_THREAT | country=KE | ASN=Surf Net Solutions Limited
Bad Web Bot
DDoS Attack
🇮🇩
hermawan
2026-07-02 12:03:58
(4 months ago)
[Thu Jul 02 19:03:51.216874 2026] [security2:error] [pid 104619:tid 140026886207168] [client 102.216.85.27:34934] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurity/ ...
show more
[Thu Jul 02 19:03:51.216874 2026] [security2:error] [pid 104619:tid 140026886207168] [client 102.216.85.27:34934] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "601"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.bmkg.go.id found within REQUEST_HEADERS:Referer: https://www.bmkg.go.id/ request_line = GET /index.php/informasi-iklim/infografis-iklim/infografis-klimat-story/555561581-mengenal-fenomena-la-nina-si-pembawa-hujan HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/informasi-iklim/infografis-iklim/infografis-klimat-story/555561581-mengenal-fenomena-la-nina-si-pembawa-hujan"] [unique_id "akZTp4fC1JcaHegMTzS1swAAkAQ"], referer https://www.bmkg.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[104624] [udDnmZ9rk5s] [akZTp4fC1JcaHegMTzS1swAAkAQ] keep_alive=[1] [
...
show less
Email Spam
Hacking
🇺🇸
pixelmemory.us
2026-06-30 10:15:45
(4 months ago)
2026-06-30T10:13:20 102.216.85.27 GET /Photos/Outdoors/2012-02-11%20Mt%20Madona/raw/IMG_4192.CR2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
...
Bad Web Bot
