🇺🇸
TPI-Abuse
2026-11-11 13:26:15
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 170.168.243.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 08:26:07.954340 2026] [security2:error] [pid 32404:tid 32404] [client 170.168.243.49:52943] ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.243.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 08:26:07.954340 2026] [security2:error] [pid 32404:tid 32404] [client 170.168.243.49:52943] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||boens.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "boens.org"] [uri "/"] [unique_id "avRs78PzUfAT-rtdNgFvhgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 12:43:32
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 170.168.243.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 07:43:27.242821 2026] [security2:error] [pid 19565:tid 19565] [client 170.168.243.49:43817] ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.243.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 07:43:27.242821 2026] [security2:error] [pid 19565:tid 19565] [client 170.168.243.49:43817] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||painting-with-numbers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "painting-with-numbers.com"] [uri "/blog/why-business-metrics-are-like-3-point-field-goals"] [unique_id "avG_7-yknxSDeJjH1wQm4QAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Ilop
2026-11-03 05:00:05
UTC ·
(1 week ago)
[hp-100] 19 unsolicited packets to honeypot ports 8080 (OCI DShield sensor)
Port Scan
🇺🇸
TPI-Abuse
2026-11-03 04:52:43
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 170.168.243.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 23:52:37.244087 2026] [security2:error] [pid 29764:tid 29764] [client 170.168.243.49:14553] ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.243.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 23:52:37.244087 2026] [security2:error] [pid 29764:tid 29764] [client 170.168.243.49:14553] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.r-390a.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.r-390a.net"] [uri "/faq-paint.htm"] [unique_id "aulolcUqV-6GLxDZyqW5qwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Ilop
2026-11-02 03:30:06
UTC ·
(1 week ago)
[hp-100] 19 unsolicited packets to honeypot ports 7547 (OCI DShield sensor)
Port Scan
🇩🇪
Ilop
2026-10-29 08:00:20
UTC ·
(2 weeks ago)
[hp-100] 19 unsolicited packets to honeypot ports 8080 (OCI DShield sensor)
Port Scan
🇩🇪
Ilop
2026-10-25 02:30:06
UTC ·
(2 weeks ago)
[hp-100] 19 unsolicited packets to honeypot ports 9000 (OCI DShield sensor)
Port Scan
🇳🇱
DonAtari
2026-10-24 18:02:16
UTC ·
(2 weeks ago)
DShield firewall scan - TCP to port 7547
Brute-Force
SSH
🇩🇪
Ilop
2026-10-21 04:00:36
UTC ·
(3 weeks ago)
[hp-100] 19 unsolicited packets to honeypot ports 9000 (OCI DShield sensor)
Port Scan
🇺🇸
TPI-Abuse
2026-10-20 17:20:14
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 170.168.243.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 13:20:01.118731 2026] [security2:error] [pid 21788:tid 21788] [client 170.168.243.49:58871] ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.243.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 13:20:01.118731 2026] [security2:error] [pid 21788:tid 21788] [client 170.168.243.49:58871] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.misscharlottemusic.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.misscharlottemusic.com"] [uri "/yourweeklylisten/page/2/"] [unique_id "ateiwbFm9546wgEVUhswYgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Ilop
2026-10-18 10:00:08
UTC ·
(3 weeks ago)
[hp-100] 19 unsolicited packets to honeypot ports 5555 (OCI DShield sensor)
Port Scan
🇩🇪
Ilop
2026-10-17 08:30:11
UTC ·
(3 weeks ago)
[hp-100] 19 unsolicited packets to honeypot ports 5555 (OCI DShield sensor)
Port Scan
🇩🇪
Ilop
2026-10-15 10:00:12
UTC ·
(4 weeks ago)
[hp-100] 19 unsolicited packets to honeypot ports 5555 (OCI DShield sensor)
Port Scan
🇫🇷
dynamix
2026-10-03 20:25:10
UTC ·
(1 month ago)
Multiple WAF Violations
Web App Attack
🇫🇷
claude CALVET
2026-08-19 18:48:02
UTC ·
(2 months ago)
gee-Joomla Admin : try to force the door...
Hacking
