🇺🇸
TPI-Abuse
2026-10-24 04:44:59
(3 hours ago)
(mod_security) mod_security (id:210350) triggered by 167.253.17.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.17.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 00:44:49.863663 2026] [security2:error] [pid 2777:tid 2777] [client 167.253.17.208:33045] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.vrbsroma.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.vrbsroma.com"] [uri "/Lucius Tarquinius Priscus.html"] [unique_id "atw3wbj7JMWgdWaKCCTScwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 19:26:17
(12 hours ago)
(mod_security) mod_security (id:210350) triggered by 167.253.17.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.17.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 15:26:06.924888 2026] [security2:error] [pid 340:tid 340] [client 167.253.17.208:62079] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.firstlovedevotions.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.firstlovedevotions.com"] [uri "/4E/4_10_evening.htm"] [unique_id "atu0zt-WCES7WFEMYTKAmgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 16:27:42
(15 hours ago)
(mod_security) mod_security (id:210350) triggered by 167.253.17.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.17.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 12:27:32.948729 2026] [security2:error] [pid 2011:tid 2011] [client 167.253.17.208:29169] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jambmaster.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jambmaster.com"] [uri "/FAQ.htm"] [unique_id "atuK9HfIHKJJpiX3ztVgsQAAACo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-22 09:20:16
(1 day ago)
| High amount of POST requests in a small period of time (likely bot).
Web App Attack
Hacking
SQL Injection
🇨🇿
Countryman
2026-09-15 00:10:01
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇸🇪
OnTheEdge
2026-09-14 09:15:37
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇸🇪
OnTheEdge
2026-09-14 09:15:37
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇿
Countryman
2026-09-14 00:10:01
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-10 04:50:38
(1 month ago)
Unauthorized VPN login attempts: 2 attempts were recorded from 167.253.17.208
2026-09-10T06:20:35+02 ...
show more
Unauthorized VPN login attempts: 2 attempts were recorded from 167.253.17.208
2026-09-10T06:20:35+02:00 vpn Access-Reject 'sh.kang' station: 167.253.17.208 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-10T06:21:53+02:00 vpn Access-Reject 'wk.kim' station: 167.253.17.208 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-04-11 03:34:58
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 167.253.17.208 (167-253-17-208.cloudairone.com) ...
show more
(mod_security) mod_security (id:225170) triggered by 167.253.17.208 (167-253-17-208.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 10 23:34:51.745829 2026] [security2:error] [pid 950552:tid 950552] [client 167.253.17.208:63165] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fattoria-rendena.it|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fattoria-rendena.it"] [uri "/wp-json/wp/v2/users"] [unique_id "adnBW5ikZ7wK5CNUN6O61QAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-09 05:07:49
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 167.253.17.208 (167-253-17-208.cloudairone.com) ...
show more
(mod_security) mod_security (id:225170) triggered by 167.253.17.208 (167-253-17-208.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 09 01:07:40.805253 2026] [security2:error] [pid 61653:tid 61653] [client 167.253.17.208:47827] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||comsew.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "comsew.com.au"] [uri "/wp-json/wp/v2/users"] [unique_id "adc0HF00nhW9-e72FyfsSwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 23:02:04
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 167.253.17.208 (167-253-17-208.cloudairone.com) ...
show more
(mod_security) mod_security (id:225170) triggered by 167.253.17.208 (167-253-17-208.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 19:01:57.778627 2026] [security2:error] [pid 3911922:tid 3911922] [client 167.253.17.208:52125] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||citizensforsanity.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "citizensforsanity.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adbeZZI0WQVOetrqwedoEAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-06 22:27:03
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 167.253.17.208 (167-253-17-208.cloudairone.com) ...
show more
(mod_security) mod_security (id:225170) triggered by 167.253.17.208 (167-253-17-208.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 18:26:55.844030 2026] [security2:error] [pid 826862:tid 826862] [client 167.253.17.208:46579] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||arsenaultartistmanagement.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "arsenaultartistmanagement.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adQzL-zKueFa9Ht762BjwAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-06 15:41:34
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 167.253.17.208 (167-253-17-208.cloudairone.com) ...
show more
(mod_security) mod_security (id:225170) triggered by 167.253.17.208 (167-253-17-208.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 11:41:25.965833 2026] [security2:error] [pid 212408:tid 212408] [client 167.253.17.208:54013] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||anthonyanimalclinic.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "anthonyanimalclinic.net"] [uri "/wp-json/wp/v2/users"] [unique_id "adPUJcn8Nw79WxZZP2noKwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
wil.com
2025-11-15 08:38:17
(11 months ago)
GlobalProtect login attempts with user akansha.mittal12.
VPN IP
Brute-Force
