🇺🇸
TPI-Abuse
2026-11-09 01:49:36
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 185.96.37.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 20:49:32.376940 2026] [security2:error] [pid 27232:tid 27232] [client 185.96.37.75:23339] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.96.37.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 20:49:32.376940 2026] [security2:error] [pid 27232:tid 27232] [client 185.96.37.75:23339] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||digitaldatatechnologies.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "digitaldatatechnologies.net"] [uri "/privacy-policy"] [unique_id "avEmrL6d2sG6CzP8ZDXlXAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 04:09:22
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 185.96.37.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 23:09:17.854107 2026] [security2:error] [pid 14479:tid 14479] [client 185.96.37.75:52451] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.96.37.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 23:09:17.854107 2026] [security2:error] [pid 14479:tid 14479] [client 185.96.37.75:52451] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.alexgitlin.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.alexgitlin.com"] [uri "/npp/uboat.htm"] [unique_id "au6kbRlgZi4YBVeK58-ZOgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 08:11:52
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.96.37.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 04:11:46.819113 2026] [security2:error] [pid 31669:tid 31669] [client 185.96.37.75:30977] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.96.37.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 04:11:46.819113 2026] [security2:error] [pid 31669:tid 31669] [client 185.96.37.75:30977] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bostonlog.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bostonlog.com"] [uri "/2013-back-at-the-hotel-our-phones-went-wild/"] [unique_id "auWiwpNvU-gWmfjj9NV6UQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇻🇳
Xuan Can
2025-06-11 02:57:38
UTC ·
(1 year ago)
(mod_security) mod_security (id:6) triggered by 185.96.37.75 (RU/Russia/-): 1 in the last 3600 secs; Ports: 80,443; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 11 09:57:31.945300 2025] [security2:error] [pid 21414:tid 21458] [client 185.96.37.75 ...
show more
(mod_security) mod_security (id:6) triggered by 185.96.37.75 (RU/Russia/-): 1 in the last 3600 secs; Ports: 80,443; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 11 09:57:31.945300 2025] [security2:error] [pid 21414:tid 21458] [client 185.96.37.75:0] ModSecurity: Access denied with connection close (phase 2). Pattern match "wp-login.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "62"] [id "6"] [severity "CRITICAL"] [hostname "sieuthimaychu.vn"] [uri "/wp-login.php"] [unique_id "aEjwmwAqHfgDUHdgH1kF9AAAAVE"]
show less
Brute-Force
SSH
🇨🇭
backslash
2025-06-04 20:10:04
UTC ·
(1 year ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
2025-04-17 10:00:00
UTC ·
(1 year ago)
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ...
show more
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user”
show less
Hacking
Brute-Force
Web App Attack
2025-04-17 10:00:00
UTC ·
(1 year ago)
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ...
show more
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user “
show less
Hacking
Brute-Force
Web App Attack
🇨🇦
wil.com
2025-03-28 08:40:06
UTC ·
(1 year ago)
GlobalProtect login attempts with user DENNISY.
VPN IP
Brute-Force
2025-03-10 06:52:18
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-03-02 08:54:41
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-02-12 12:12:18
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2024-09-04 05:54:09
UTC ·
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 185.96.37.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 04 01:54:02.996998 2024] [security2:error] [pid 19885:tid 19885] [client 185.96.37.75:32801] [cl ...
show more
(mod_security) mod_security (id:225170) triggered by 185.96.37.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 04 01:54:02.996998 2024] [security2:error] [pid 19885:tid 19885] [client 185.96.37.75:32801] [client 185.96.37.75] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||al-bukhari.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "al-bukhari.org"] [uri "/wp-json/wp/v2/users"] [unique_id "Ztf1-pYcOsg7iwzbnI-oPwAAAA8"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
TI
2023-10-28 10:14:18
UTC ·
(3 years ago)
Scrapping website, using diffrent useragents, not wait for response, #botnet20231026
DDoS Attack
Bad Web Bot
