🇫🇮
kumiko
2026-11-07 13:04:44
UTC ·
(8 hours ago)
[2026-11-07 15:04:44] Known bad bot [Mozilla/5.0 (Linux; Android 6.0; MI 5 Build/MRA58K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/53.0.2785.49 Mobile MQQBrowser/6.2 TBS/043305 Safari/537.36 MicroMessenger/6.5.8.1060 NetType/WIFI ...
show more
[2026-11-07 15:04:44] Known bad bot [Mozilla/5.0 (Linux; Android 6.0; MI 5 Build/MRA58K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/53.0.2785.49 Mobile MQQBrowser/6.2 TBS/043305 Safari/537.36 MicroMessenger/6.5.8.1060 NetType/WIFI Language/zh_CN]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 13:20:25
UTC ·
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 159.75.35.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 08:20:20.135858 2026] [security2:error] [pid 6851:tid 6851] [client 159.75.35.32:65479] ModSe ...
show more
(mod_security) mod_security (id:210831) triggered by 159.75.35.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 08:20:20.135858 2026] [security2:error] [pid 6851:tid 6851] [client 159.75.35.32:65479] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.jsw4.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.jsw4.net"] [uri "/"] [unique_id "au3UFAM0Q8DBQZR4AK8LRwAAABg"], referer: https://m.baidu.com/s?word=www.ddddi.cn
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-11-06 03:05:40
UTC ·
(1 day ago)
[FriNov0604:05:36.1668512026][security2:error][pid1815583:tid1815711][client159.75.35.32:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(http://bsalsa\\\\\\\\.com\|\^site24x7\)\"against\"REQUEST_HEADERS:User-Agent\"required.[file\"/etc/a ...
show more
[FriNov0604:05:36.1668512026][security2:error][pid1815583:tid1815711][client159.75.35.32:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(http://bsalsa\\\\\\\\.com\|\^site24x7\)\"against\"REQUEST_HEADERS:User-Agent\"required.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"282\"][id\"330094\"][rev\"5\"][msg\"Atomicorp.comWAFRules:CompromisedUser-AgentAgentAttackblocked\"][severity\"CRITICAL\"][hostname\"www.r102.ch\"][uri\"/\"][unique_id\"au1EAMnZTAZQG2KRR1J18gAAAQ4\"]\,referer:https://m.baidu.com/s\?word=www.ddddi.cn
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 02:53:19
UTC ·
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 159.75.35.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 21:53:14.228725 2026] [security2:error] [pid 2425:tid 2425] [client 159.75.35.32:61137] ModSe ...
show more
(mod_security) mod_security (id:210831) triggered by 159.75.35.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 21:53:14.228725 2026] [security2:error] [pid 2425:tid 2425] [client 159.75.35.32:61137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.wmionline.org|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.wmionline.org"] [uri "/"] [unique_id "au1BGsrZJetQetdv7BEXcwAAABo"], referer: https://m.baidu.com/s?word=www.ddddi.cn
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 00:39:56
UTC ·
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 159.75.35.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 19:39:51.067558 2026] [security2:error] [pid 18593:tid 18593] [client 159.75.35.32:58354] Mod ...
show more
(mod_security) mod_security (id:210831) triggered by 159.75.35.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 19:39:51.067558 2026] [security2:error] [pid 18593:tid 18593] [client 159.75.35.32:58354] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.fgrotary.org|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.fgrotary.org"] [uri "/"] [unique_id "au0h15JS18fgpTI8zWae0wAAAAE"], referer: https://m.baidu.com/s?word=www.ddddi.cn
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
kumiko
2026-11-05 20:27:39
UTC ·
(2 days ago)
[2026-11-05 22:27:38] Known bad bot [Mozilla/5.0 (Linux; Android 7.1.2; vivo X9 Build/N2G47H; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 MQQBrowser/6.2 TBS/044103 Mobile Safari/537.36 V1_AND_SQ_7.6.3_852_YYB_D QQ/7.6. ...
show more
[2026-11-05 22:27:38] Known bad bot [Mozilla/5.0 (Linux; Android 7.1.2; vivo X9 Build/N2G47H; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 MQQBrowser/6.2 TBS/044103 Mobile Safari/537.36 V1_AND_SQ_7.6.3_852_YYB_D QQ/7.6.3.3565 NetType/WIFI WebP/0.3.0 Pixel/1080]
show less
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-11-04 21:33:43
UTC ·
(3 days ago)
HTTP application-layer DoS / botnet traffic from 159.75.35.32: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇫🇮
kumiko
2026-11-04 03:03:51
UTC ·
(3 days ago)
[2026-11-04 05:03:50] File probing [6 in a quick succession]
"HEAD /en HTTP/1.1" 200
"HEAD / HTTP/1.1" 302
"HEAD / HTTP/1.1" 301
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-11-03 04:58:28
UTC ·
(4 days ago)
HTTP application-layer DoS / botnet traffic from 159.75.35.32: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇫🇮
kumiko
2026-11-02 13:03:21
UTC ·
(5 days ago)
[2026-11-02 15:03:21] Persistent attack/probing over several days.
Port Scan
Brute-Force
Bad Web Bot
🇫🇮
kumiko
2026-11-02 12:43:18
UTC ·
(5 days ago)
[2026-11-02 14:43:18] Known bad bot [Mozilla/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/7.0.3(0x17000321) NetType/4G Language/zh_CN]
Bad Web Bot
Web App Attack
🇫🇷
ecodehost.com
2026-11-02 06:47:04
UTC ·
(5 days ago)
Domain : secertarim.com.tr
Rule : Method-Head
2026-11-02 06:45:06 10.100.1.20 HEAD / - 80 - 159.75.35.32 HTTP/1.1 Mozilla/5.0 (Linux; Android 8.1.0; PACT00 Build/O11019; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/63.0.3239.83 Mobil ...
show more
Domain : secertarim.com.tr
Rule : Method-Head
2026-11-02 06:45:06 10.100.1.20 HEAD / - 80 - 159.75.35.32 HTTP/1.1 Mozilla/5.0 (Linux; Android 8.1.0; PACT00 Build/O11019; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/63.0.3239.83 Mobile Safari/537.36 T7/11.10 baiduboxapp/11.10.0.12 (Baidu; P1 8.1.0) https://m.baidu.com/s?word=www.ddddi.cn www.secertarim.com.tr 301 0 0 174 386 284 - -
show less
Port Scan
🇺🇸
cwytech
2026-11-02 00:25:34
UTC ·
(5 days ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-geofence-sus.
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-11-01 16:18:23
UTC ·
(6 days ago)
HTTP application-layer DoS / botnet traffic from 159.75.35.32: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇵🇱
sefinek.net
2026-11-01 13:18:58
UTC ·
(6 days ago)
Triggered Cloudflare WAF (firewallCustom) from CN.
Action: BLOCK | Protocol: HTTP/1.1 (HEAD) | Endpoint: / | UA: Mozilla/5.0 (Linux; Android 6.0.1; HUAWEI RIO-AL00 Build/HuaweiRIO-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/48 ...
show more
Triggered Cloudflare WAF (firewallCustom) from CN.
Action: BLOCK | Protocol: HTTP/1.1 (HEAD) | Endpoint: / | UA: Mozilla/5.0 (Linux; Android 6.0.1; HUAWEI RIO-AL00 Build/HuaweiRIO-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/48.0.2564.116 Mobile Safari/537.36 T7/10.2 baiduboxapp/10.2.3.10 (Baidu; P1 6.0.1) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
