🇺🇸
TPI-Abuse
2026-11-13 15:35:32
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:35:25.835232 2026] [security2:error] [pid 31928:tid 31928] [client 185.94.32.188:34493] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:35:25.835232 2026] [security2:error] [pid 31928:tid 31928] [client 185.94.32.188:34493] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ofertasdetrabajosyempleos.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ofertasdetrabajosyempleos.com"] [uri "/espana/buscador-dependienta-toledo.php"] [unique_id "avcuPf8i7H1O-X-WFEoglgAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 03:19:32
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 22:19:27.147374 2026] [security2:error] [pid 32116:tid 32116] [client 185.94.32.188:64633] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 22:19:27.147374 2026] [security2:error] [pid 32116:tid 32116] [client 185.94.32.188:64633] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||acmax.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "acmax.com"] [uri "/home/index.php/thermometers-hygrometers-data-loggers-2/thermostat-data-logger-2/erc-30b-ne-2"] [unique_id "avaBv2fzQxCFJPoTd57K3QAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 18:03:30
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 13:03:27.043580 2026] [security2:error] [pid 9091:tid 9091] [client 185.94.32.188:64809] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 13:03:27.043580 2026] [security2:error] [pid 9091:tid 9091] [client 185.94.32.188:64809] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/posts/7662"] [unique_id "avX_b8qCsURQWskvVoWbfwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 18:43:52
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 13:43:48.485568 2026] [security2:error] [pid 20194:tid 20194] [client 185.94.32.188:29631] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 13:43:48.485568 2026] [security2:error] [pid 20194:tid 20194] [client 185.94.32.188:29631] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lightningbug.farm|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lightningbug.farm"] [uri "/category/recipes/soups/feed/"] [unique_id "au4f5A_73J7lfrkDXUMJFwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-02 12:00:14
UTC ·
(1 week ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-10-30 16:16:02
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 12:15:55.613674 2026] [security2:error] [pid 26764:tid 26764] [client 185.94.32.188:38945] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 12:15:55.613674 2026] [security2:error] [pid 26764:tid 26764] [client 185.94.32.188:38945] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.alexgitlin.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.alexgitlin.com"] [uri "/npp/titanic.htm"] [unique_id "auTCu5GLGcD9jKwN4l9CKgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 11:58:49
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 07:58:44.493339 2026] [security2:error] [pid 25781:tid 25781] [client 185.94.32.188:21577] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 07:58:44.493339 2026] [security2:error] [pid 25781:tid 25781] [client 185.94.32.188:21577] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||w0kem.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "w0kem.com"] [uri "/w0mtl/directions.htm"] [unique_id "auHjdFmJp9P-eEQ7YMS1ZQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-16 00:10:02
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇸🇪
OnTheEdge
2026-09-14 18:42:09
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇸🇪
OnTheEdge
2026-09-14 18:42:09
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇫🇮
JimArchon72
2026-04-26 19:30:01
UTC ·
(6 months ago)
2026/04/26 19:25:36 "GET /wp-login.php HTTP/1.1"
Web App Attack
🇺🇸
TPI-Abuse
2026-01-01 18:10:41
UTC ·
(10 months ago)
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 01 13:10:35.795213 2026] [security2:error] [pid 32573:tid 32573] [client 185.94.32.188:21405] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.32.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 01 13:10:35.795213 2026] [security2:error] [pid 32573:tid 32573] [client 185.94.32.188:21405] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||iconconstructors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "iconconstructors.com"] [uri "/projects/verizon"] [unique_id "aVa4m3KKPkXF126Q4azhZAAAABE"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇳
PortArmor.net
2025-12-01 04:53:47
UTC ·
(11 months ago)
UDP flood/amplification attempt srcport 22451 dstport 123 length 1351
Fraud Orders
Bad Web Bot
2025-09-05 08:23:52
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-02-16 11:39:29
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
