🇩🇪
Vegascosmetics
2026-11-08 16:05:44
UTC ·
(4 hours ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after locale-probe / error-handler fuzzing against ASP.NET shop. Evidence: LOCALE-PROBE: Cluster Berater de17848 (5 IPs/15 Min)
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 10:06:43
UTC ·
(10 hours ago)
(mod_security) mod_security (id:210350) triggered by 170.168.240.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 05:06:38.800378 2026] [security2:error] [pid 18054:tid 18054] [client 170.168.240.226:3451 ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.240.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 05:06:38.800378 2026] [security2:error] [pid 18054:tid 18054] [client 170.168.240.226:34513] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||celebritybikinigossip.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "celebritybikinigossip.com"] [uri "/2013/04/kelly-bensimon-bikini-pictures-7/"] [unique_id "avBJrr7Nrh0z6e_TOZdjTQAAAG0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 19:55:53
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 170.168.240.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 14:55:49.811446 2026] [security2:error] [pid 7456:tid 7456] [client 170.168.240.226:43261] ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.240.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 14:55:49.811446 2026] [security2:error] [pid 7456:tid 7456] [client 170.168.240.226:43261] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jerusalem-temple-today.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jerusalem-temple-today.com"] [uri "/for/viewtopic.php"] [unique_id "auzfRcEzRoB0CZshHi6MxQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 18:00:20
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 170.168.240.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 14:00:15.794859 2026] [security2:error] [pid 29861:tid 29861] [client 170.168.240.226:2453 ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.240.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 14:00:15.794859 2026] [security2:error] [pid 29861:tid 29861] [client 170.168.240.226:24535] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2015/12/14/120-8-million-american-adults/"] [unique_id "auOJr2pxrRWxOQ_2uJl5sQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
librebit
2026-09-30 11:55:12
UTC ·
(1 month ago)
Brute force
Brute-Force
🇪🇸
librebit
2026-09-29 09:52:36
UTC ·
(1 month ago)
Brute force
Brute-Force
🇪🇸
librebit
2026-09-27 04:29:54
UTC ·
(1 month ago)
Brute force
Brute-Force
🇪🇸
librebit
2026-09-25 16:16:51
UTC ·
(1 month ago)
Brute force
Brute-Force
🇪🇸
librebit
2026-06-24 06:27:19
UTC ·
(4 months ago)
Brute force
Brute-Force
🇺🇸
nationaleventpros.com
2026-03-31 08:46:32
UTC ·
(7 months ago)
WordPress login attempt
Brute-Force
🇺🇦
URAN Publishing Service
2026-03-23 20:32:38
UTC ·
(7 months ago)
170.168.240.226 - - [23/Mar/2026:22:32:38 +0200] "GET /wp-login.php HTTP/1.1" 404 209 "-" "Wget/1.21.4"
170.168.240.226 - - [23/Mar/2026:22:32:38 +0200] "GET /wp-admin/ HTTP/1.1" 404 503 "-" "curl/7.88.1"
...
Web App Attack
🇺🇸
TPI-Abuse
2026-01-22 18:46:31
UTC ·
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 170.168.240.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 13:46:24.398489 2026] [security2:error] [pid 22016:tid 22103] [client 170.168.240.226:3097 ...
show more
(mod_security) mod_security (id:225170) triggered by 170.168.240.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 13:46:24.398489 2026] [security2:error] [pid 22016:tid 22103] [client 170.168.240.226:30973] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mcdonaldmountainranch.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mcdonaldmountainranch.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXJwgNA1Hzf3h2ggBNX4pQAAAIE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nationaleventpros.com
2025-12-05 18:58:50
UTC ·
(11 months ago)
WordPress login attempt
Brute-Force
🇺🇸
TPI-Abuse
2025-11-15 17:37:53
UTC ·
(11 months ago)
(mod_security) mod_security (id:210350) triggered by 170.168.240.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 15 12:37:49.934733 2025] [security2:error] [pid 14557:tid 14557] [client 170.168.240.226:6179 ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.240.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 15 12:37:49.934733 2025] [security2:error] [pid 14557:tid 14557] [client 170.168.240.226:61795] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||waking.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "waking.com"] [uri "/"] [unique_id "aRi6bQ0Qxf01OiQSO3LgsAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-15 17:22:21
UTC ·
(11 months ago)
(mod_security) mod_security (id:210350) triggered by 170.168.240.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 15 12:22:13.205473 2025] [security2:error] [pid 26278:tid 26278] [client 170.168.240.226:1262 ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.240.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 15 12:22:13.205473 2025] [security2:error] [pid 26278:tid 26278] [client 170.168.240.226:12627] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||norun.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "norun.net"] [uri "/"] [unique_id "aRi2xeJn6yrkIewE-fo3vAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
