🇺🇸
TPI-Abuse
2026-11-09 06:57:55
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 176.126.104.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 01:57:50.295379 2026] [security2:error] [pid 14379:tid 14379] [client 176.126.104.93:59947] ...
show more
(mod_security) mod_security (id:210350) triggered by 176.126.104.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 01:57:50.295379 2026] [security2:error] [pid 14379:tid 14379] [client 176.126.104.93:59947] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.themadwriter.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.themadwriter.us"] [uri "/beware-of-shiny-objects-1551.htm"] [unique_id "avFu7hob9hbox4bmRAKKXQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 00:45:52
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 176.126.104.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 19:45:47.433254 2026] [security2:error] [pid 1500:tid 1500] [client 176.126.104.93:58157] M ...
show more
(mod_security) mod_security (id:210350) triggered by 176.126.104.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 19:45:47.433254 2026] [security2:error] [pid 1500:tid 1500] [client 176.126.104.93:58157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ctrussell.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ctrussell.us"] [uri "/d01f9bc2626a96a38625699900786730/2adb81139ef7a91f8625645200830147_7b4ad6db.html"] [unique_id "avEXuzVhwiXlrPoJG8mOUgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 21:09:47
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 176.126.104.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 16:09:40.535741 2026] [security2:error] [pid 26198:tid 26198] [client 176.126.104.93:37193] ...
show more
(mod_security) mod_security (id:210350) triggered by 176.126.104.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 16:09:40.535741 2026] [security2:error] [pid 26198:tid 26198] [client 176.126.104.93:37193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2015/02/14/senegal-au-launch-universal-jurisdiction-prosecution-of-ex-chad-dictator/"] [unique_id "au5CFPUDhZnFjwXMKGZbAgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 10:47:23
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 176.126.104.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 06:47:17.029422 2026] [security2:error] [pid 3363:tid 3363] [client 176.126.104.93:63865] M ...
show more
(mod_security) mod_security (id:210350) triggered by 176.126.104.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 06:47:17.029422 2026] [security2:error] [pid 3363:tid 3363] [client 176.126.104.93:63865] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||thewanderinghermit.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "thewanderinghermit.com"] [uri "/x-person/biography.htm"] [unique_id "auMkNWtsoDrjawxvnjuKbQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇮
administrator
2026-10-22 22:06:24
UTC ·
(2 weeks ago)
2026-10-19 17:45:54,039 fail2ban.actions [1165]: NOTICE [apache-fakegooglebot] Ban 176.126.104.93
2026-10-19 17:45:54,039 fail2ban.actions [1165]: NOTICE [apache-fakegooglebot] Ban 176.126.104.93
2026-10-19 17:45:54,039 fail2ban.actio ...
show more
2026-10-19 17:45:54,039 fail2ban.actions [1165]: NOTICE [apache-fakegooglebot] Ban 176.126.104.93
2026-10-19 17:45:54,039 fail2ban.actions [1165]: NOTICE [apache-fakegooglebot] Ban 176.126.104.93
2026-10-19 17:45:54,039 fail2ban.actions [1165]: NOTICE [apache-fakegooglebot] Ban 176.126.104.93
...
show less
Bad Web Bot
Web Spam
Email Spam
Blog Spam
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 10:22:21
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 176.126.104.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 06:22:17.965413 2026] [security2:error] [pid 11924:tid 11924] [client 176.126.104.93:51543] ...
show more
(mod_security) mod_security (id:210350) triggered by 176.126.104.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 06:22:17.965413 2026] [security2:error] [pid 11924:tid 11924] [client 176.126.104.93:51543] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.flatchestedmama.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.flatchestedmama.com"] [uri "/archive/jean-pool"] [unique_id "atiSWSxDRWqh7F8m9KGxUwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
OnTheEdge
2026-09-14 18:31:15
UTC ·
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇸🇪
OnTheEdge
2026-09-14 18:31:15
UTC ·
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇿
lp
2026-09-14 06:21:50
UTC ·
(1 month ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 176.126.104.93
2026-09-14T07:31:51+02:00 vpn Access-Reject 'Saima.cati.390' station: 176.126.104.93 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 176.126.104.93
2026-09-14T07:31:51+02:00 vpn Access-Reject 'Saima.cati.390' station: 176.126.104.93 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-09-14 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-10 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇭
SOC [GOLINE SA]
2026-09-09 03:45:59
UTC ·
(2 months ago)
[RoutePulse | 2026-09-09T03:45:59Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 176.126.104.93
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed attack (3 attempts/15min) — shun on the VPN ...
show more
[RoutePulse | 2026-09-09T03:45:59Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 176.126.104.93
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed attack (3 attempts/15min) — shun on the VPN gateway
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
Brute-Force
Hacking
🇨🇿
Countryman
2026-09-09 03:30:55
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇮🇹
alessio loto
2026-03-18 17:44:54
UTC ·
(7 months ago)
WAF Detection: Security_Scanner_Blocked. AI Confirmed Attack Payload.
Bad Web Bot
🇩🇪
Packets-Decreaser.NET
2025-11-17 16:51:21
UTC ·
(11 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
