diff --git a/modules/security/live-attack-monitor.sh b/modules/security/live-attack-monitor.sh
index 7dad43d..d09ac70 100755
--- a/modules/security/live-attack-monitor.sh
+++ b/modules/security/live-attack-monitor.sh
@@ -256,8 +256,8 @@ update_ip_intelligence() {
         record_attack_pattern "$ip" "${attacks:-unknown}" "$url" "${user_agent:-unknown}" 2>/dev/null &
     fi
 
-    # Detect attacks in URL
-    local new_attacks=$(detect_all_attacks "$url" "$method")
+    # Detect attacks in URL (pass user_agent and ip for enhanced detection)
+    local new_attacks=$(detect_all_attacks "$url" "$method" "$user_agent" "$ip")
 
     if [ -n "$new_attacks" ]; then
         # Add to attack list (unique)