🇩🇪
4server
2026-11-14 23:12:10
UTC ·
(17 hours ago)
[SunNov1500:12:06.2214602026][security2:error][pid549067:tid549105][client185.168.31.75:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:alter\|drop\)\\\\\\\\b[a-z0-9] \\\\\\\\b\(\?:column\|database\|procedure\|table\) ...
show more
[SunNov1500:12:06.2214602026][security2:error][pid549067:tid549105][client185.168.31.75:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:alter\|drop\)\\\\\\\\b[a-z0-9] \\\\\\\\b\(\?:column\|database\|procedure\|table\)\\\\\\\\b\|delete[[:space:]].{1\,100} update[a-z0-9] set.{1\,100} =\|unionallselect\|\\\\\\\\bunion\\\\\\\\b.{1\,100}\?\\\\\\\\bselect\\\\\\\\b.{0\,200}[a-z0-9] from\|select\(\?:load_file\|char\?\\\\\\\\\(\)\|\(\?:insert\|r...\"atARGS:requests[1][body][requests][1][path].[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"315\"][id\"340144\"][rev\"38\"][msg\"Atomicorp.comWAFRules:GenericSQLinjectionprotection2\"][data\"135837\"][severity\"CRITICAL\"][tag\"SQLi\"][hostname\"kvsm-blackstone.com\"][uri\"/\"][unique_id\"avjqxr1D_C00sRzV8g-HFAAAAIM\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
Zandro
2026-11-12 12:00:14
UTC ·
(3 days ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-11 12:04:18
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 07:04:11.671322 2026] [security2:error] [pid 2844:tid 2844] [client 185.168.31.75:28381] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 07:04:11.671322 2026] [security2:error] [pid 2844:tid 2844] [client 185.168.31.75:28381] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||asiabeef.network|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "asiabeef.network"] [uri "/presenter-biographies.html"] [unique_id "avRZu8Afp5faKMHMTVZI2wAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 06:20:14
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 01:20:05.437540 2026] [security2:error] [pid 17687:tid 17687] [client 185.168.31.75:30769] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 01:20:05.437540 2026] [security2:error] [pid 17687:tid 17687] [client 185.168.31.75:30769] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||trasimeno.ws|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "trasimeno.ws"] [uri "/oasi_it.html"] [unique_id "avK3lXH-EDbnpoxD7fnqMAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-08 00:40:00
UTC ·
(1 week ago)
Multiple Violations by Botnets
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 02:37:34
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 22:37:31.696054 2026] [security2:error] [pid 28331:tid 28331] [client 185.168.31.75:50845] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 22:37:31.696054 2026] [security2:error] [pid 28331:tid 28331] [client 185.168.31.75:50845] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||tulsatvmemories.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "tulsatvmemories.com"] [uri "/tulradi2.html"] [unique_id "auVUax-7x9ABwGezDthtigAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
klaus_ph
2026-10-30 00:16:05
UTC ·
(2 weeks ago)
[Thu Oct 29 22:13:56.097949 2026] [ssl:info] [pid 892415] [client 185.168.31.75:49441] AH01964: Connection to child 17 established (server fit.vufindnet.de:443)
...
Hacking
🇺🇸
TPI-Abuse
2026-10-29 16:19:53
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 12:19:46.814812 2026] [security2:error] [pid 25791:tid 25821] [client 185.168.31.75:45631] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 12:19:46.814812 2026] [security2:error] [pid 25791:tid 25821] [client 185.168.31.75:45631] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||certifiedprojectmanager.eu|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "certifiedprojectmanager.eu"] [uri "/Online-Training-in-Project-Management.html"] [unique_id "auNyInrMhkEMiXapNow_TAAAAQk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 12:03:29
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 08:03:23.402079 2026] [security2:error] [pid 16739:tid 16739] [client 185.168.31.75:53173] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 08:03:23.402079 2026] [security2:error] [pid 16739:tid 16739] [client 185.168.31.75:53173] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ielts-english.info|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ielts-english.info"] [uri "/blog/"] [unique_id "auHki-VokhiijrXRZths5gAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 05:34:09
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 01:34:01.121005 2026] [security2:error] [pid 17915:tid 18027] [client 185.168.31.75:13635] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 01:34:01.121005 2026] [security2:error] [pid 17915:tid 18027] [client 185.168.31.75:13635] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.sailcleaner.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.sailcleaner.com"] [uri "/faq/"] [unique_id "athOyQLwwIdkQKI-WVOkkQAAAVg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-05-31 20:37:54
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 16:37:50.614195 2026] [security2:error] [pid 7989:tid 7989] [client 185.168.31.75:27393] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 16:37:50.614195 2026] [security2:error] [pid 7989:tid 7989] [client 185.168.31.75:27393] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||teguer.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "teguer.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahycHiQZK9zCWa8y2eb85gAAABI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 21:34:55
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 17:34:51.272561 2026] [security2:error] [pid 8016:tid 8016] [client 185.168.31.75:50761] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 185.168.31.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 17:34:51.272561 2026] [security2:error] [pid 8016:tid 8016] [client 185.168.31.75:50761] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||staben.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "staben.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahTAeyezHU9Q4Ejixgs5awAAAAI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Bedios GmbH
2026-04-14 09:01:33
UTC ·
(7 months ago)
Wordpress hacking attempt
Web App Attack
🇩🇪
LRob
2026-04-07 22:45:15
UTC ·
(7 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
