🇺🇸
EGP Abuse Dept
2026-10-22 09:39:01
(51 minutes ago)
forum signup bot
Web Spam
Blog Spam
Web App Attack
2026-10-22 00:46:39
(9 hours ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇳🇱
GES
2026-10-21 07:34:36
(1 day ago)
Credential scanning on player_api.php (5 distinct logins in 120s). Auto-blocked by XUI Shield.
DDoS Attack
Port Scan
2026-10-20 23:19:23
(1 day ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇩🇪
LRob
2026-10-19 20:22:57
(2 days ago)
Not following 301 redirects — wasted requests | method: GET | path: https://dhsdigital.eu/wp-login.p ...
show more
Not following 301 redirects — wasted requests | method: GET | path: https://dhsdigital.eu/wp-login.php | ua: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
show less
Bad Web Bot
2026-10-18 19:02:40
(3 days ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 12:27:10
(3 days ago)
(mod_security) mod_security (id:210740) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210740) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 08:27:04.677604 2026] [security2:error] [pid 20436:tid 20436] [client 72.56.73.23:46032] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy||stormwlf.com:443|F|4"] [data "/proxy-connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "stormwlf.com"] [uri "/"] [unique_id "atS7GM2eeK_SPGlqqCA1PwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 09:59:13
(4 days ago)
(mod_security) mod_security (id:210740) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210740) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 05:59:07.379242 2026] [security2:error] [pid 7499:tid 7499] [client 72.56.73.23:45810] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy||jolankagroup.com:443|F|4"] [data "/proxy-connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "jolankagroup.com"] [uri "/"] [unique_id "atSYawZQiGsu7dtMB9iEfwAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 12:55:19
(4 days ago)
(mod_security) mod_security (id:210740) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210740) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 08:55:13.483668 2026] [security2:error] [pid 6175:tid 6175] [client 72.56.73.23:55880] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy||footballxp.com:443|F|4"] [data "/proxy-connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "footballxp.com"] [uri "/"] [unique_id "atNwMXX0BlhMX0GesSRqzwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 12:25:11
(6 days ago)
(mod_security) mod_security (id:217210) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:217210) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 08:25:02.781750 2026] [security2:error] [pid 4161:tid 4161] [client 72.56.73.23:50712] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||www.worthhistory.org:443|F|4"] [data "CONNECT www.worthhistory.org:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.worthhistory.org"] [uri "/"] [unique_id "atDGHhoa-tyyB5Ng3OR5jgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 10:11:36
(1 week ago)
(mod_security) mod_security (id:210740) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210740) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 06:11:30.719213 2026] [security2:error] [pid 22701:tid 22701] [client 72.56.73.23:33838] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy||lbee.com:443|F|4"] [data "/proxy-connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "lbee.com"] [uri "/"] [unique_id "atCm0qeLYwkEpT-8dBpFpQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-14 08:32:46
(1 week ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 04:25:27
(1 week ago)
(mod_security) mod_security (id:217210) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:217210) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 00:25:20.032199 2026] [security2:error] [pid 7099:tid 7099] [client 72.56.73.23:34500] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||www.falundafatr.org:443|F|4"] [data "CONNECT www.falundafatr.org:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.falundafatr.org"] [uri "/"] [unique_id "as8EMHiBkTFlmuZ_nJOtFAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
polycoda
2026-10-14 00:52:29
(1 week ago)
AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based)
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 08:52:04
(1 week ago)
(mod_security) mod_security (id:210740) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210740) triggered by 72.56.73.23 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 04:51:57.492738 2026] [security2:error] [pid 2532:tid 2532] [client 72.56.73.23:53056] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy||art.mavikalem.org:443|F|4"] [data "/proxy-connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "art.mavikalem.org"] [uri "/"] [unique_id "asyfrTiV9oJPU_iW4kYdhwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack