🇫🇷
aki
2026-11-07 08:27:35
UTC ·
(5 days ago)
PortScan: TCP/22
Port Scan
🇩🇪
ValtonTahiri
2026-09-18 02:06:20
UTC ·
(1 month ago)
UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=104.28.152.201; proto=TCP; source_port=55807; targ ...
show more
UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=104.28.152.201; proto=TCP; source_port=55807; target_port=21
show less
Port Scan
🇳🇱
jjnxpct
2026-04-15 03:49:25
UTC ·
(6 months ago)
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: / (Rule ID: 920210) - Multiple/Conflicting Connection Header Data Found
Web App Attack
🇳🇱
jjnxpct
2026-04-14 03:48:21
UTC ·
(6 months ago)
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: / (Rule ID: 920210) - Multiple/Conflicting Connection Header Data Found
Web App Attack
🇫🇷
masterguru
2026-04-13 10:54:06
UTC ·
(6 months ago)
Multiple/Conflicting Connection Header Data Found. Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. (920210-196)
Hacking
🇺🇸
TPI-Abuse
2026-04-11 22:31:15
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 18:31:07.470006 2026] [security2:error] [pid 3780735:tid 3780735] [client 104.28.152.201:12 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 18:31:07.470006 2026] [security2:error] [pid 3780735:tid 3780735] [client 104.28.152.201:12110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||the-it-man.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "the-it-man.com"] [uri "/"] [unique_id "adrLq2hd1uBCB0C5EsTz9wAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-10 18:07:20
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 10 14:07:15.640213 2026] [security2:error] [pid 4137961:tid 4137961] [client 104.28.152.201:14 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 10 14:07:15.640213 2026] [security2:error] [pid 4137961:tid 4137961] [client 104.28.152.201:14302] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||gvimmobilier.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "gvimmobilier.com"] [uri "/"] [unique_id "adk8U7kyW3D71qEbBQlSuwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-10 15:51:26
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 10 11:51:22.436895 2026] [security2:error] [pid 544729:tid 544729] [client 104.28.152.201:1424 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 10 11:51:22.436895 2026] [security2:error] [pid 544729:tid 544729] [client 104.28.152.201:14246] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.adj-tech.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.adj-tech.net"] [uri "/"] [unique_id "adkcejHI5AyprbrFg-rCKwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-09 20:31:37
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 09 16:31:29.174938 2026] [security2:error] [pid 1060064:tid 1060064] [client 104.28.152.201:12 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 09 16:31:29.174938 2026] [security2:error] [pid 1060064:tid 1060064] [client 104.28.152.201:12549] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenaultartistmanagement.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenaultartistmanagement.com"] [uri "/"] [unique_id "adgMoSY1iMyc2sQI4rHR_QAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
jjnxpct
2026-04-09 03:56:39
UTC ·
(7 months ago)
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: / (Rule ID: 920210) - Multiple/Conflicting Connection Header Data Found
Web App Attack
🇺🇸
TPI-Abuse
2026-04-09 03:46:55
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 23:46:51.295010 2026] [security2:error] [pid 3415182:tid 3415182] [client 104.28.152.201:13 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 23:46:51.295010 2026] [security2:error] [pid 3415182:tid 3415182] [client 104.28.152.201:13715] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||kraftrentals.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "kraftrentals.com"] [uri "/"] [unique_id "adchK3cykZPaFz4JnruoQgAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 22:06:18
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 18:06:12.860732 2026] [security2:error] [pid 2983134:tid 2983134] [client 104.28.152.201:14 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 18:06:12.860732 2026] [security2:error] [pid 2983134:tid 2983134] [client 104.28.152.201:14165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||slattery-law.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "slattery-law.com"] [uri "/"] [unique_id "adbRVAehx_TqaR9ZcOEH3AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 20:08:01
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 16:07:52.360646 2026] [security2:error] [pid 2586392:tid 2586392] [client 104.28.152.201:12 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 16:07:52.360646 2026] [security2:error] [pid 2586392:tid 2586392] [client 104.28.152.201:12274] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||vittariabeauty.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "vittariabeauty.com"] [uri "/"] [unique_id "ada1mJqcMmlY151YsEwYlgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 12:44:49
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 08:44:43.304932 2026] [security2:error] [pid 2826331:tid 2826331] [client 104.28.152.201:11 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 08:44:43.304932 2026] [security2:error] [pid 2826331:tid 2826331] [client 104.28.152.201:11852] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ammatusk.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ammatusk.com"] [uri "/"] [unique_id "adZNu4XJrAW2gQ9vghGu4AAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 11:50:07
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 07:49:59.928775 2026] [security2:error] [pid 4175105:tid 4175105] [client 104.28.152.201:13 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 07:49:59.928775 2026] [security2:error] [pid 4175105:tid 4175105] [client 104.28.152.201:13343] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||appliedcam.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "appliedcam.com"] [uri "/"] [unique_id "adZA5491e-zPa3Gq5SbSYgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
