🇺🇸
TPI-Abuse
2026-11-07 23:13:22
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:13:18.821001 2026] [security2:error] [pid 11800:tid 11800] [client 162.252.53.16:24255] M ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:13:18.821001 2026] [security2:error] [pid 11800:tid 11800] [client 162.252.53.16:24255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/author/deana/page/3/"] [unique_id "au-wjii3zY_81p-f-4Mw5gAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 07:49:10
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 02:49:06.579673 2026] [security2:error] [pid 12668:tid 12668] [client 162.252.53.16:41629] M ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 02:49:06.579673 2026] [security2:error] [pid 12668:tid 12668] [client 162.252.53.16:41629] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ricketyshack.ca|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ricketyshack.ca"] [uri "/web/"] [unique_id "aumR8ugTjyI5RCBpn_5g7gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 18:18:25
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 13:18:19.007754 2026] [security2:error] [pid 11794:tid 11794] [client 162.252.53.16:65077] M ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 13:18:19.007754 2026] [security2:error] [pid 11794:tid 11794] [client 162.252.53.16:65077] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.fgrotary.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fgrotary.org"] [uri "/speaker/economic-development-update/"] [unique_id "aujT6nyaYluBvauJmUuoewAAADE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 00:38:39
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 20:38:32.635300 2026] [security2:error] [pid 3746:tid 3746] [client 162.252.53.16:12619] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 20:38:32.635300 2026] [security2:error] [pid 3746:tid 3746] [client 162.252.53.16:12619] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||williamgilcher.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "williamgilcher.com"] [uri "/robots.txt"] [unique_id "auPnCCSIuvHvD8CD9w_HawAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 18:13:52
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 14:13:45.345625 2026] [security2:error] [pid 12686:tid 12686] [client 162.252.53.16:46177] M ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 14:13:45.345625 2026] [security2:error] [pid 12686:tid 12686] [client 162.252.53.16:46177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||mdgcontrols.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "mdgcontrols.com"] [uri "/AC-VFD-Safe-Torque-Off--STO-.php"] [unique_id "auDp2aVtbBUGslOhRjYjlAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 14:19:56
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 162.252.53.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 10:19:52.696373 2026] [security2:error] [pid 10252:tid 10252] [client 162.252.53.16:15945] M ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.53.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 10:19:52.696373 2026] [security2:error] [pid 10252:tid 10252] [client 162.252.53.16:15945] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||georgelaceysales.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "georgelaceysales.com"] [uri "/spotlight-solaframe-hog-4.html"] [unique_id "atttCIUaTIwzC233hnMUuQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇭🇷
bubausluge
2026-10-03 10:25:42
UTC ·
(1 month ago)
Blocked by https://aegis.hr — WebHost: ModSecurity CRS Alert - (MITRE T1190), 3 attempts, Period: 2026-10-03 10:07:51 to 2026-10-03 10:07:51
Web App Attack
Bad Web Bot
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇸🇪
OnTheEdge
2026-09-08 17:24:01
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇩🇪
C C
2026-08-06 23:55:54
UTC ·
(3 months ago)
Distributed scraping attack: 3436 req from 3224 rotating proxy IPs, waves of up to 156 req in 138s on a single URL | this IP: 1 req, 1 blocked
Bad Web Bot
Web App Attack
🇫🇮
JimArchon72
2026-06-21 05:25:02
UTC ·
(4 months ago)
2026/06/21 05:24:56 "GET /wp-login.php?action=register HTTP/1.1"
Web App Attack
🇫🇷
Baking333
2026-05-12 00:30:58
UTC ·
(5 months ago)
[redacted] 162.252.53.16 - - [12/May/2026:01:30:55 +0100] "GET /[redacted] HTTP/1.1" 302 1518 0/244694 "https://[redacted]" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" [redacted] 162.252.53. ...
show more
[redacted] 162.252.53.16 - - [12/May/2026:01:30:55 +0100] "GET /[redacted] HTTP/1.1" 302 1518 0/244694 "https://[redacted]" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" [redacted] 162.252.53.16 - - [12/May/2026:01:30:57 +0100] "GET /[redacted] HTTP/1.1" 302 1518 0/43328 "https://[redacted]" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
show less
Bad Web Bot
Web App Attack
