🇺🇸
TPI-Abuse
2026-11-10 03:54:00
UTC ·
(11 hours ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:53:54.198222 2026] [security2:error] [pid 17076:tid 17076] [client 167.253.18.112:20081] ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:53:54.198222 2026] [security2:error] [pid 17076:tid 17076] [client 167.253.18.112:20081] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.perthdps.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.perthdps.com"] [uri "/convicts/canadian.html"] [unique_id "avKVUmurb58ukBq-xQDtRgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 02:09:13
UTC ·
(13 hours ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 21:09:03.766501 2026] [security2:error] [pid 4150:tid 4150] [client 167.253.18.112:23043] M ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 21:09:03.766501 2026] [security2:error] [pid 4150:tid 4150] [client 167.253.18.112:23043] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.thingstodonude.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.thingstodonude.com"] [uri "/beach-voyeurism/young-pussy-made-a-noticeable-cameltoe-in-bikini/"] [unique_id "avJ8v_pkKOtx8vQhl0IxLQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 13:13:56
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 08:13:45.278454 2026] [security2:error] [pid 19735:tid 19735] [client 167.253.18.112:12899] ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 08:13:45.278454 2026] [security2:error] [pid 19735:tid 19735] [client 167.253.18.112:12899] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.salinabible.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.salinabible.org"] [uri "/info-articles/audio-messages/speaker/3-dr-jim-fritz"] [unique_id "avHHCQnr8wVoj3YqKurF0wAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-11-05 07:55:49
UTC ·
(5 days ago)
HTTP application-layer DoS / botnet traffic from 167.253.18.112: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-10-31 08:19:07
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 04:19:01.859009 2026] [security2:error] [pid 17911:tid 17911] [client 167.253.18.112:32731] ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 04:19:01.859009 2026] [security2:error] [pid 17911:tid 17911] [client 167.253.18.112:32731] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.flavornet.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.flavornet.org"] [uri "/info/30021-74-0.html"] [unique_id "auWkdfr-gGs4EgDsx7ZbrQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-10-29 09:06:07
UTC ·
(1 week ago)
block ruleset 798ECF92F12ADC636D3520C2890AF17ADEFDE3BE
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-26 08:04:40
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 04:04:31.427314 2026] [security2:error] [pid 4694:tid 4694] [client 167.253.18.112:22653] M ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 04:04:31.427314 2026] [security2:error] [pid 4694:tid 4694] [client 167.253.18.112:22653] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||persnicketyinc.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "persnicketyinc.com"] [uri "/tag/english-garden/"] [unique_id "at8Jj5SdQRDQMO_jQZR_igAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
JimArchon72
2026-10-12 15:15:02
UTC ·
(4 weeks ago)
2026/10/12 15:10:57 "GET /wp-login.php?action=register HTTP/1.1"
Web App Attack
🇬🇧
relianoid.com
2026-08-28 13:33:35
UTC ·
(2 months ago)
POST Abuse detected by Relianoid OSS Load Balancer - relianoid.com
Web Spam
2026-07-14 04:20:00
UTC ·
(3 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇺🇸
mw
2026-07-02 08:58:24
UTC ·
(4 months ago)
VPN bruteforce
Brute-Force
🇺🇸
TPI-Abuse
2026-04-21 07:44:49
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 167.253.18.112 (167-253-18-112.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 21 03:44:44.716878 2026] [security2:error] [pid 1260867:tid 12608 ...
show more
(mod_security) mod_security (id:225170) triggered by 167.253.18.112 (167-253-18-112.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 21 03:44:44.716878 2026] [security2:error] [pid 1260867:tid 1260867] [client 167.253.18.112:58905] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||dmasoftlab.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dmasoftlab.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aecq7L6TyXSNF9cOhwaWUAAAAAs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-02-24 17:35:52
UTC ·
(8 months ago)
Bad bot ignoring robot.txt
Bad Web Bot
🇮🇩
Burayot
2025-10-07 03:55:47
UTC ·
(1 year ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 167.253.18.112 (US/United States/167-253-18-112.cloudairone.com): 1 in the last 3600 secs
Web App Attack
