🇺🇸
TPI-Abuse
2026-11-14 09:33:14
UTC ·
(22 minutes ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:33:07.404429 2026] [security2:error] [pid 28749:tid 28749] [client 162.252.53.152:36649] ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:33:07.404429 2026] [security2:error] [pid 28749:tid 28749] [client 162.252.53.152:36649] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jerusalem-temple-today.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jerusalem-temple-today.com"] [uri "/for/viewtopic.php"] [unique_id "avgq03O0NJQbPwdKsczUFQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 10:29:04
UTC ·
(23 hours ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 05:28:58.942359 2026] [security2:error] [pid 23460:tid 23487] [client 162.252.53.152:16799] ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 05:28:58.942359 2026] [security2:error] [pid 23460:tid 23487] [client 162.252.53.152:16799] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||newyorkfreepress.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "newyorkfreepress.com"] [uri "/Copy-(4)-of-New-York-Gazette-Oldest-Newspaper-USA-New-York.html"] [unique_id "avbmakeoPIvPgyPBVwlvPQAAANY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-12 20:00:14
UTC ·
(1 day ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-08 20:17:43
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 15:17:38.130019 2026] [security2:error] [pid 19364:tid 19364] [client 162.252.53.152:58933] ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 15:17:38.130019 2026] [security2:error] [pid 19364:tid 19364] [client 162.252.53.152:58933] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paleopathologist.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paleopathologist.com"] [uri "/uncategorized/how-much-protein-is-right-high-protein-low-moderate/"] [unique_id "avDY4he2tkhr6lU4lVWOIAAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 11:38:38
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 06:38:33.897477 2026] [security2:error] [pid 32478:tid 32478] [client 162.252.53.152:15693] ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 06:38:33.897477 2026] [security2:error] [pid 32478:tid 32478] [client 162.252.53.152:15693] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||freepatternstocrochet.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "freepatternstocrochet.com"] [uri "/st-patricks-irish-crochet-patterns.htm"] [unique_id "avBfOXpH7zXPDFmxbTi_mgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 12:35:08
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 07:35:05.800918 2026] [security2:error] [pid 1008:tid 1008] [client 162.252.53.152:46417] M ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 07:35:05.800918 2026] [security2:error] [pid 1008:tid 1008] [client 162.252.53.152:46417] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||theateroobleck.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "theateroobleck.com"] [uri "/news/happiness-takes-cleveland-and-houston-by-storm"] [unique_id "aunU-WDToNoVossJsG4vuwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 01:38:53
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 21:38:46.808102 2026] [security2:error] [pid 3660:tid 3660] [client 162.252.53.152:14845] M ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 21:38:46.808102 2026] [security2:error] [pid 3660:tid 3660] [client 162.252.53.152:14845] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||christineohlman.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "christineohlman.net"] [uri "/about.html"] [unique_id "atwMJpZFAIaLHLxYiFy95gAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 08:32:22
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 04:32:18.365326 2026] [security2:error] [pid 6895:tid 6895] [client 162.252.53.152:13097] M ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 04:32:18.365326 2026] [security2:error] [pid 6895:tid 6895] [client 162.252.53.152:13097] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||agenesis7.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "agenesis7.com"] [uri "/Products/Test/TstPtf9902.htm"] [unique_id "atsbkuIKyIKxIBKHW_NJpQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 22:28:14
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 18:28:10.452466 2026] [security2:error] [pid 19950:tid 19950] [client 162.252.53.152:46849] ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 18:28:10.452466 2026] [security2:error] [pid 19950:tid 19950] [client 162.252.53.152:46849] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cipcug.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cipcug.org"] [uri "/Command/mess1202.cfm"] [unique_id "atk8ekBHalFcUbwyylLCSQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-25 11:19:40
UTC ·
(1 month ago)
2026-09-25T13:19:39.980004+02:00 polaris wp(sahpa.co.za)[2256173]: Authentication attempt for unknown user
[email protected] from 162.252.53.152
...
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-09-15 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-14 00:22:10
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 4 attempts were recorded from 162.252.53.152
2026-09-14T00:55:47+02:00 vpn Access-Reject '[email protected] ' station: 162.252.53.152 auth-type: - realm: DEFAULT nas: <redacted> called: <redacted> => addre ...
show more
Unauthorized VPN login attempts: 4 attempts were recorded from 162.252.53.152
2026-09-14T00:55:47+02:00 vpn Access-Reject '[email protected] ' station: 162.252.53.152 auth-type: - realm: DEFAULT nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-14T00:57:09+02:00 vpn Access-Reject 'testpr' station: 162.252.53.152 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-14T00:58:30+02:00 vpn Access-Reject 'guest' station: 162.252.53.152 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-14T00:59:51+02:00 vpn Access-Reject 'rizwan' station: 162.252.53.152 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-09-14 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-10 04:50:36
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 162.252.53.152
2026-09-10T05:54:20+02:00 vpn Access-Reject 'mgokdemir' station: 162.252.53.152 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<red ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 162.252.53.152
2026-09-10T05:54:20+02:00 vpn Access-Reject 'mgokdemir' station: 162.252.53.152 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
