🇺🇸
TPI-Abuse
2026-11-13 13:09:00
UTC ·
(4 hours ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 08:08:51.008582 2026] [security2:error] [pid 32572:tid 32572] [client 167.253.18.105:16775] ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 08:08:51.008582 2026] [security2:error] [pid 32572:tid 32572] [client 167.253.18.105:16775] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||forum.whodatnation.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "forum.whodatnation.com"] [uri "/search.php"] [unique_id "avcL4xvOX5TnoMSOI8WUuQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 11:38:40
UTC ·
(6 hours ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 06:38:33.090095 2026] [security2:error] [pid 8502:tid 8502] [client 167.253.18.105:26463] M ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 06:38:33.090095 2026] [security2:error] [pid 8502:tid 8502] [client 167.253.18.105:26463] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ctrussell.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ctrussell.us"] [uri "/ctrussell/ctrussell.nsf/Supplemental"] [unique_id "avb2uUGQI4k4JbHMoSjhRAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 10:06:55
UTC ·
(7 hours ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 05:06:42.135920 2026] [security2:error] [pid 24699:tid 24699] [client 167.253.18.105:40479] ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 05:06:42.135920 2026] [security2:error] [pid 24699:tid 24699] [client 167.253.18.105:40479] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ofertasdetrabajosyempleos.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ofertasdetrabajosyempleos.com"] [uri "/espana/buscador-practicas-lugo.php"] [unique_id "avbhMpqG26RT6dVL2NF9AgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 08:41:56
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:41:43.046445 2026] [security2:error] [pid 30317:tid 30317] [client 167.253.18.105:60849] ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:41:43.046445 2026] [security2:error] [pid 30317:tid 30317] [client 167.253.18.105:60849] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.freepatternstocrochet.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.freepatternstocrochet.com"] [uri "/free-crochet-scarf-patterns.htm"] [unique_id "aumeR5yrufjt_8fSSp4qZAAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 22:17:58
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 17:17:41.083767 2026] [security2:error] [pid 21678:tid 21678] [client 167.253.18.105:51653] ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 17:17:41.083767 2026] [security2:error] [pid 21678:tid 21678] [client 167.253.18.105:51653] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lightningbug.farm|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lightningbug.farm"] [uri "/wp-json/wp/v2/categories/26"] [unique_id "aukMBa_0fEYXWIxTfNC4PAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 01:33:49
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 21:33:43.660651 2026] [security2:error] [pid 22508:tid 22508] [client 167.253.18.105:40573] ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 21:33:43.660651 2026] [security2:error] [pid 22508:tid 22508] [client 167.253.18.105:40573] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/tag/democrats/"] [unique_id "auPz9_3vV72LeWfcf9bPFQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 19:14:24
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 15:14:14.406522 2026] [security2:error] [pid 21380:tid 21380] [client 167.253.18.105:54315] ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 15:14:14.406522 2026] [security2:error] [pid 21380:tid 21380] [client 167.253.18.105:54315] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.natural-history-conservation.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.natural-history-conservation.com"] [uri "/SkyeIchthyosaur.htm"] [unique_id "at-mhp8GXguSmI4bjpVuHQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-15 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-14 07:50:17
UTC ·
(1 month ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 167.253.18.105
2026-09-14T09:19:11+02:00 vpn Access-Reject 'test' station: 167.253.18.105 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 167.253.18.105
2026-09-14T09:19:11+02:00 vpn Access-Reject 'test' station: 167.253.18.105 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇩🇪
NxtGenIT
2026-09-10 12:22:34
UTC ·
(2 months ago)
CiscoASA Honeypot hit, Payload: "GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1" 200 -,
Brute-Force
🇺🇸
TPI-Abuse
2026-07-01 07:06:33
UTC ·
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 167.253.18.105 (167-253-18-105.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 03:06:28.027173 2026] [security2:error] [pid 7632:tid 7632] [c ...
show more
(mod_security) mod_security (id:225170) triggered by 167.253.18.105 (167-253-18-105.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 03:06:28.027173 2026] [security2:error] [pid 7632:tid 7632] [client 167.253.18.105:56807] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lumentravel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lumentravel.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akS8dPUjvwJR4By4tcklBgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 18:04:40
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 167.253.18.105 (167-253-18-105.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 14:04:36.877759 2026] [security2:error] [pid 3104:tid 3104] [c ...
show more
(mod_security) mod_security (id:225170) triggered by 167.253.18.105 (167-253-18-105.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 14:04:36.877759 2026] [security2:error] [pid 3104:tid 3104] [client 167.253.18.105:64047] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||darnorb.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "darnorb.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aimnNNdHBWoc-dijjbJEFAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-03-01 21:05:38
UTC ·
(8 months ago)
Fail2Ban banned 167.253.18.105 for security violations in jail wp-armour. Log: 2026/03/01 21:05:38 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 167.253.18.105 | Target: wplogin" , client: 167.253.18.105, server: [REDACTED], reque ...
show more
Fail2Ban banned 167.253.18.105 for security violations in jail wp-armour. Log: 2026/03/01 21:05:38 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 167.253.18.105 | Target: wplogin" , client: 167.253.18.105, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇺🇸
TPI-Abuse
2026-02-21 05:41:39
UTC ·
(8 months ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (167-253-18-105.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 21 00:41:31.025557 2026] [security2:error] [pid 22448:tid 22448] ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.105 (167-253-18-105.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 21 00:41:31.025557 2026] [security2:error] [pid 22448:tid 22448] [client 167.253.18.105:61917] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||evolute.io|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "evolute.io"] [uri "/"] [unique_id "aZlFiznY0h4ZazULG7O-ywAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
