🇬🇧
abivia
2026-11-13 17:32:35
UTC ·
(1 day ago)
Abivia WAF trigger: Rule scriptKiddies: Probing for vulnerabilities uri: /oembed.php?url=https%3A%2F%2Fambitonline.com%2Fnextrelease%2F2011%2F01%2Faudience-the-social-media-killer%2F&format=xml
Hacking
🇺🇸
TPI-Abuse
2026-11-13 00:11:17
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 185.168.30.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:11:10.941532 2026] [security2:error] [pid 15464:tid 15464] [client 185.168.30.252:59851] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.168.30.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:11:10.941532 2026] [security2:error] [pid 15464:tid 15464] [client 185.168.30.252:59851] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||circleway.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "circleway.org"] [uri "/changingtheworld/ctw06.html"] [unique_id "avZVnhAiLPPET8F0bWNvzQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 10:19:52
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.168.30.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 06:19:47.992144 2026] [security2:error] [pid 2780:tid 2813] [client 185.168.30.252:16055] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.168.30.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 06:19:47.992144 2026] [security2:error] [pid 2780:tid 2813] [client 185.168.30.252:16055] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||howardhallis.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "howardhallis.com"] [uri "/doctorstrange/foreign/files/js/expressInstall.swf"] [unique_id "auRvQ1bdaukY3LBliymKvgAAAJM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 21:04:34
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.168.30.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 17:04:27.138721 2026] [security2:error] [pid 3889:tid 3889] [client 185.168.30.252:39313] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.168.30.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 17:04:27.138721 2026] [security2:error] [pid 3889:tid 3889] [client 185.168.30.252:39313] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.doctorc.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.doctorc.net"] [uri "/Labs/Lab19/NOTES/Peristal.htm"] [unique_id "auER219SFPk3yTiihkIIAAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
lp
2026-09-13 03:21:47
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 185.168.30.252
2026-09-13T04:46:53+02:00 vpn Access-Reject 'brv044' station: 185.168.30.252 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redact ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 185.168.30.252
2026-09-13T04:46:53+02:00 vpn Access-Reject 'brv044' station: 185.168.30.252 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇦🇺
welife
2026-09-12 12:16:06
UTC ·
(2 months ago)
Hammering the XML-RPC endpoint against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
185.168.30.252 - - [12/Sep/2026:22:14:35 +1000] "POST /xmlrpc.php HTTP/2" 403 63 "-" ...
show more
Hammering the XML-RPC endpoint against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
185.168.30.252 - - [12/Sep/2026:22:14:35 +1000] "POST /xmlrpc.php HTTP/2" 403 63 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
show less
Web App Attack
🇨🇭
backslash
2026-04-02 00:06:31
UTC ·
(7 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇮🇹
VHosting
2026-03-26 19:57:22
UTC ·
(7 months ago)
Detected attack and reported by a human
Brute-Force
Web App Attack
SSH
DDoS Attack
Exploited Host
Bad Web Bot
🇺🇸
mnsf
2026-03-19 16:12:32
UTC ·
(7 months ago)
Scanning/Probing (14)
Brute-Force
Web App Attack
