🇺🇸
TPI-Abuse
2026-11-11 01:46:01
UTC ·
(20 hours ago)
(mod_security) mod_security (id:210350) triggered by 170.168.175.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:45:55.610219 2026] [security2:error] [pid 21545:tid 21545] [client 170.168.175.146:1465 ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.175.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:45:55.610219 2026] [security2:error] [pid 21545:tid 21545] [client 170.168.175.146:14659] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||garon.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "garon.us"] [uri "/images2/obits/Buchman, Sidney obit story 1902-1975.htm"] [unique_id "avPI0-W1hDTcUuGhgv897QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 11:54:06
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 170.168.175.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:54:00.901718 2026] [security2:error] [pid 21042:tid 21042] [client 170.168.175.146:6459 ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.175.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:54:00.901718 2026] [security2:error] [pid 21042:tid 21042] [client 170.168.175.146:64591] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.davidharrisgriffith.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.davidharrisgriffith.com"] [uri "/new-orleans/the-whisper-garden/its-real/"] [unique_id "avMF2GbrrRSqyXMQ84eZmgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 10:33:35
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 170.168.175.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:33:29.040622 2026] [security2:error] [pid 22091:tid 22091] [client 170.168.175.146:2139 ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.175.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:33:29.040622 2026] [security2:error] [pid 22091:tid 22091] [client 170.168.175.146:21397] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.clowaterart.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.clowaterart.com"] [uri "/E6A/slides/JUN_7002.html"] [unique_id "avLy-fEUxikxeDu0PHK5lwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
librebit
2026-11-09 07:44:56
UTC ·
(2 days ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-10-29 13:18:19
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 170.168.175.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 09:18:12.827969 2026] [security2:error] [pid 31105:tid 31105] [client 170.168.175.146:3885 ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.175.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 09:18:12.827969 2026] [security2:error] [pid 31105:tid 31105] [client 170.168.175.146:38857] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ctrussell.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ctrussell.us"] [uri "/test/ctrussell.nsf/3e8bddb381ab8aff862566bd000abc73/b9ade1079d9dae2d0625645b00551391"] [unique_id "auNHlHbEcwvQqlILOdVeBwAAADM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 17:21:40
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 170.168.175.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 13:21:33.952028 2026] [security2:error] [pid 4672:tid 4672] [client 170.168.175.146:40341] ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.175.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 13:21:33.952028 2026] [security2:error] [pid 4672:tid 4672] [client 170.168.175.146:40341] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||firstlovedevotions.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "firstlovedevotions.com"] [uri "/2E/2_4_evening.htm"] [unique_id "auIvHZg5i2btdQbt-f-iWwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 21:59:56
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 170.168.175.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 17:59:49.668537 2026] [security2:error] [pid 14160:tid 14160] [client 170.168.175.146:5167 ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.175.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 17:59:49.668537 2026] [security2:error] [pid 14160:tid 14160] [client 170.168.175.146:51679] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||1214productions.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "1214productions.com"] [uri "/fellowship.html"] [unique_id "auEe1dbzsO83wVwI91BVNAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
DonAtari
2026-10-17 13:49:55
UTC ·
(3 weeks ago)
DShield firewall scan - TCP to port 8080
Brute-Force
SSH
🇸🇪
OnTheEdge
2026-09-13 18:19:23
UTC ·
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇸🇪
OnTheEdge
2026-09-13 18:19:23
UTC ·
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇭
SOC [GOLINE SA]
2026-09-10 22:01:00
UTC ·
(2 months ago)
[RoutePulse | 2026-09-10T22:01:00Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 170.168.175.146
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — shunned by the FTD's own threat detection (adopted by R ...
show more
[RoutePulse | 2026-09-10T22:01:00Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 170.168.175.146
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — shunned by the FTD's own threat detection (adopted by RoutePulse: TTL, strike, diary)
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
Brute-Force
Hacking
🇸🇪
OnTheEdge
2026-09-09 03:13:55
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇺🇸
nationaleventpros.com
2026-09-05 04:49:01
UTC ·
(2 months ago)
WordPress login attempt
Brute-Force
🇺🇸
nationaleventpros.com
2026-09-03 03:00:48
UTC ·
(2 months ago)
WordPress login attempt
Brute-Force
