🇺🇸
TPI-Abuse
2026-11-11 23:38:40
UTC ·
(7 hours ago)
(mod_security) mod_security (id:210350) triggered by 170.168.97.126 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:38:36.130143 2026] [security2:error] [pid 1431:tid 1431] [client 170.168.97.126:19823] M ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.97.126 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:38:36.130143 2026] [security2:error] [pid 1431:tid 1431] [client 170.168.97.126:19823] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/posts/3159"] [unique_id "avT8fCKnapVsnFE8glNnDgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-10 04:54:50
UTC ·
(2 days ago)
Automated scanner probing RD Web Access login pages
Bad Web Bot
Web App Attack
🇪🇸
librebit
2026-11-10 01:09:06
UTC ·
(2 days ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-11-09 07:48:58
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 170.168.97.126 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 02:48:52.296751 2026] [security2:error] [pid 9175:tid 9175] [client 170.168.97.126:57635] M ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.97.126 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 02:48:52.296751 2026] [security2:error] [pid 9175:tid 9175] [client 170.168.97.126:57635] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lightningbug.farm|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lightningbug.farm"] [uri "/recipes/main-dish/pork/fried-pork-tenderloin-sandwich/"] [unique_id "avF65M4wlhN-6KqOo8E99wAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 13:49:08
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 170.168.97.126 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:49:02.156231 2026] [security2:error] [pid 21692:tid 21701] [client 170.168.97.126:44993] ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.97.126 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:49:02.156231 2026] [security2:error] [pid 21692:tid 21701] [client 170.168.97.126:44993] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cargomarexpress.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cargomarexpress.com"] [uri "/product/xopticianryx3035182"] [unique_id "avB9zroqsuvd-Tm3ACShYAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 13:37:33
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 170.168.97.126 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 08:37:26.045741 2026] [security2:error] [pid 18837:tid 18837] [client 170.168.97.126:51075] ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.97.126 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 08:37:26.045741 2026] [security2:error] [pid 18837:tid 18837] [client 170.168.97.126:51075] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2015/08/30/the-only-way-is-blair/"] [unique_id "aunjllkFGFmjewDl9NAZnAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-03 01:04:08
UTC ·
(1 week ago)
Automated scanner probing RD Web Access login pages
Bad Web Bot
Web App Attack
🇪🇸
librebit
2026-10-24 00:58:21
UTC ·
(2 weeks ago)
Brute force
Brute-Force
2026-10-23 15:38:54
UTC ·
(2 weeks ago)
Automated scanner probing RD Web Access login pages
Bad Web Bot
Web App Attack
🇪🇸
librebit
2026-10-08 19:18:58
UTC ·
(1 month ago)
Brute force
Brute-Force
2026-10-08 19:14:34
UTC ·
(1 month ago)
Automated scanner probing RD Web Access login pages
Bad Web Bot
Web App Attack
🇪🇸
librebit
2026-09-24 06:08:44
UTC ·
(1 month ago)
Brute force
Brute-Force
🇪🇸
librebit
2026-09-22 20:43:55
UTC ·
(1 month ago)
Brute force
Brute-Force
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇩🇪
FD-IX
2026-09-02 22:11:03
UTC ·
(2 months ago)
Brute-force login attack detected by WordPress firewall.
Brute-Force
Web App Attack
