🇺🇸
TPI-Abuse
2026-11-14 10:36:21
UTC ·
(10 minutes ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 05:36:14.492748 2026] [security2:error] [pid 31461:tid 31461] [client 104.28.152.237:58250] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 05:36:14.492748 2026] [security2:error] [pid 31461:tid 31461] [client 104.28.152.237:58250] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||beach98.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "beach98.com"] [uri "/"] [unique_id "avg5nhIfbDenCo_HBnzjlAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-14 10:16:47
UTC ·
(29 minutes ago)
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.152.237 - - [14/Nov/2026:11:16:36 +0100] "GET /.env.production HTTP/1.1" 404 10156 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) Apple ...
show more
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.152.237 - - [14/Nov/2026:11:16:36 +0100] "GET /.env.production HTTP/1.1" 404 10156 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 09:32:08
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:32:01.781179 2026] [security2:error] [pid 12711:tid 12711] [client 104.28.152.237:60129] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:32:01.781179 2026] [security2:error] [pid 12711:tid 12711] [client 104.28.152.237:60129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||turtletaekwondo.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "turtletaekwondo.com"] [uri "/"] [unique_id "avgqkaTkDbyaWyrEfRaguQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 08:39:16
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 03:39:11.856002 2026] [security2:error] [pid 28027:tid 28027] [client 104.28.152.237:59518] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 03:39:11.856002 2026] [security2:error] [pid 28027:tid 28027] [client 104.28.152.237:59518] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||guarinofurnituredesigns.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "guarinofurnituredesigns.com"] [uri "/"] [unique_id "avgeL7aO_GeKBL0PTrgcMwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 04:48:13
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 23:48:08.031282 2026] [security2:error] [pid 12588:tid 12588] [client 104.28.152.237:59352] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 23:48:08.031282 2026] [security2:error] [pid 12588:tid 12588] [client 104.28.152.237:59352] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||reparcol.es|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "reparcol.es"] [uri "/"] [unique_id "avfoCH7NvfrKKTJDHg_sjwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 04:28:54
UTC ·
(6 hours ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 23:28:47.118922 2026] [security2:error] [pid 30357:tid 30357] [client 104.28.152.237:59763] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 23:28:47.118922 2026] [security2:error] [pid 30357:tid 30357] [client 104.28.152.237:59763] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||albionglobalmarketing.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "albionglobalmarketing.com"] [uri "/"] [unique_id "avfjfz6Ahw4-p5eFrUXIBAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 01:09:34
UTC ·
(9 hours ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 20:09:29.035261 2026] [security2:error] [pid 14562:tid 14562] [client 104.28.152.237:57897] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 20:09:29.035261 2026] [security2:error] [pid 14562:tid 14562] [client 104.28.152.237:57897] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||centrodentalsindolor.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "centrodentalsindolor.com"] [uri "/"] [unique_id "ave0yRpcjOWH5G-u7UaSTwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Roper123
2026-11-13 17:25:44
UTC ·
(17 hours ago)
Web exploits
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 17:17:29
UTC ·
(17 hours ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 12:17:24.219385 2026] [security2:error] [pid 28516:tid 28516] [client 104.28.152.237:59608] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 12:17:24.219385 2026] [security2:error] [pid 28516:tid 28516] [client 104.28.152.237:59608] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||kiinlog.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "kiinlog.com"] [uri "/"] [unique_id "avdGJBKSilIIjwh0rvuXqwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 16:55:09
UTC ·
(17 hours ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 11:55:02.645077 2026] [security2:error] [pid 1204536:tid 1204536] [client 104.28.152.237:59 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 11:55:02.645077 2026] [security2:error] [pid 1204536:tid 1204536] [client 104.28.152.237:59791] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||mikekornrich.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "mikekornrich.com"] [uri "/"] [unique_id "avdA5txPq_oET4VB4BS6tQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 15:40:34
UTC ·
(19 hours ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:40:30.329226 2026] [security2:error] [pid 25251:tid 25251] [client 104.28.152.237:58688] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:40:30.329226 2026] [security2:error] [pid 25251:tid 25251] [client 104.28.152.237:58688] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||emelecsrl.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "emelecsrl.com"] [uri "/"] [unique_id "avcvbvauhEy5pgX7BbdAeQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 14:14:21
UTC ·
(20 hours ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 09:14:13.910454 2026] [security2:error] [pid 16363:tid 16363] [client 104.28.152.237:59345] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 09:14:13.910454 2026] [security2:error] [pid 16363:tid 16363] [client 104.28.152.237:59345] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||gsrsv.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "gsrsv.org"] [uri "/"] [unique_id "avcbNdNiPe6_xB00byaTDQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
pltcldvlpr
2026-11-13 10:07:16
UTC ·
(1 day ago)
CMS/framework probe: 104.28.152.237 - - [13/Nov/2026:11:07:16 +0100] "GET /secrets.json HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15" asn=13335 org="Cloudfla ...
show more
CMS/framework probe: 104.28.152.237 - - [13/Nov/2026:11:07:16 +0100] "GET /secrets.json HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15" asn=13335 org="Cloudflare, Inc." country=CA
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 08:56:38
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 03:56:31.368580 2026] [security2:error] [pid 25590:tid 25590] [client 104.28.152.237:58512] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 03:56:31.368580 2026] [security2:error] [pid 25590:tid 25590] [client 104.28.152.237:58512] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||majersigns.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "majersigns.com"] [uri "/"] [unique_id "avbQv15AJ6tEBSmdTc2vGQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 08:29:16
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 03:29:10.303298 2026] [security2:error] [pid 5009:tid 5009] [client 104.28.152.237:59876] M ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.152.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 03:29:10.303298 2026] [security2:error] [pid 5009:tid 5009] [client 104.28.152.237:59876] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||premaindustrial.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "premaindustrial.com"] [uri "/"] [unique_id "avbKVuFPNccrbxEdEmVoWgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
