🇺🇸
TPI-Abuse
2026-11-10 00:56:46
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:56:32.998307 2026] [security2:error] [pid 1440:tid 1440] [client 167.253.18.148:22793] M ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:56:32.998307 2026] [security2:error] [pid 1440:tid 1440] [client 167.253.18.148:22793] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cbcfargo.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cbcfargo.com"] [uri "/site/Resources/devotionals/2025-01-05.php"] [unique_id "avJrwKQ9uVBez2FW0ugumgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 07:46:00
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 03:45:53.494753 2026] [security2:error] [pid 15540:tid 15540] [client 167.253.18.148:20747] ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 03:45:53.494753 2026] [security2:error] [pid 15540:tid 15540] [client 167.253.18.148:20747] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||museum.henning.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "museum.henning.org"] [uri "/dfhm002"] [unique_id "auRLMcc_PFc-BEmfsqbrKQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 16:23:31
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 167.253.18.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 12:23:17.142737 2026] [security2:error] [pid 15740:tid 15740] [client 167.253.18.148:47813] ...
show more
(mod_security) mod_security (id:210350) triggered by 167.253.18.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 12:23:17.142737 2026] [security2:error] [pid 15740:tid 15740] [client 167.253.18.148:47813] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.niximperial.biz|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.niximperial.biz"] [uri "/c3s_14.html"] [unique_id "auNy9cXWnRNH7D4CRW1MEwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-15 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-14 06:22:05
UTC ·
(1 month ago)
Unauthorized VPN login attempts: 2 attempts were recorded from 167.253.18.148
2026-09-14T07:30:01+02:00 vpn Access-Reject 'wajid' station: 167.253.18.148 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacte ...
show more
Unauthorized VPN login attempts: 2 attempts were recorded from 167.253.18.148
2026-09-14T07:30:01+02:00 vpn Access-Reject 'wajid' station: 167.253.18.148 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-14T07:31:21+02:00 vpn Access-Reject 'hardikb' station: 167.253.18.148 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-09-14 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
2026-08-30 20:41:18
UTC ·
(2 months ago)
Global Protect brute force attempt
Brute-Force
Web App Attack
2026-08-20 19:37:47
UTC ·
(2 months ago)
VPN portal credential brute-force / password spray against a SAML-only GlobalProtect portal (31 attempt(s) observed, 31 username(s) tried). Source blocked on our perimeter.
Brute-Force
2026-08-19 21:47:51
UTC ·
(2 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇦🇺
MAGIC
2026-05-24 01:17:18
UTC ·
(5 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
2026-05-15 03:23:07
UTC ·
(5 months ago)
Banned by Fail2Ban on server
Bad Web Bot
🇮🇩
Burayot
2026-05-13 19:50:42
UTC ·
(5 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 167.253.18.148 (US/United States/167-253-18-148.cloudairone.com): 2 in the last 3600 secs
Web App Attack
2026-05-08 04:47:46
UTC ·
(6 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 07-47.167.253.18.148.web-spammers.v2.rbl.imunify.com._v4 succeeded.
Web App Attack
🇩🇪
Lino Project
2026-05-05 09:16:00
UTC ·
(6 months ago)
167.253.18.148 - - [05/May/2026:11:15:59 +0200] "GET /wp-admin/post-new.php HTTP/1.1" 403 6488 "https://www.primobio.it/mio-account/?action=register" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Sa ...
show more
167.253.18.148 - - [05/May/2026:11:15:59 +0200] "GET /wp-admin/post-new.php HTTP/1.1" 403 6488 "https://www.primobio.it/mio-account/?action=register" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
GabrielJST
2026-02-03 12:17:06
UTC ·
(9 months ago)
(wordpress) Failed wordpress login from 167.253.18.148 (US/United States/167-253-18-148.cloudairone.com)
Brute-Force
