🇺🇸
TPI-Abuse
2026-10-27 00:56:38
(6 hours ago)
(mod_security) mod_security (id:210350) triggered by 186.96.198.111 (host-186.96.198.111.luronet.com ...
show more
(mod_security) mod_security (id:210350) triggered by 186.96.198.111 (host-186.96.198.111.luronet.com.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 20:56:34.942987 2026] [security2:error] [pid 28176:tid 28176] [client 186.96.198.111:41352] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||mysticbitchsalon.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "mysticbitchsalon.com"] [uri "/"] [unique_id "at_2wobQPCqhy3psd9LigQAAAA0"], referer: https://five.co.in/redirect.php?ref_host=joeduffymusic.co.uk
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 07:05:33
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 186.96.198.111 (host-186.96.198.111.luronet.com ...
show more
(mod_security) mod_security (id:210350) triggered by 186.96.198.111 (host-186.96.198.111.luronet.com.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 03:05:25.402662 2026] [security2:error] [pid 9088:tid 9088] [client 186.96.198.111:48318] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||spiralingmedia.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "spiralingmedia.com"] [uri "/"] [unique_id "ar4GNYuV2pWBUSuVNPwpjAAAAAc"], referer: https://paidbacklinks.shop/dir/seo-ranking-links-196022
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-17 05:00:49
(5 months ago)
BruteForce IMAP/POP3/SMTP
Brute-Force
🇩🇪
ksol-hostmaster
2026-05-09 13:55:40
(5 months ago)
May 9 15:55:40 ksol dovecot[58127]: auth-worker(81125): conn unix:auth-worker (uid=143): auth-worke ...
show more
May 9 15:55:40 ksol dovecot[58127]: auth-worker(81125): conn unix:auth-worker (uid=143): auth-worker<3>: sql(anonymized@email,186.96.198.111,<EIFc3mJRwoO6YMZv>): Password mismatch (given password: I-AM-A-SUCKER-USING-A-WRONG-PASSWORD)
...
show less
Brute-Force
🇬🇧
D3monite
2026-05-09 10:59:59
(5 months ago)
Attempted Brute Force (dovecot)
Brute-Force
2026-05-09 09:00:50
(5 months ago)
Authentication failure
Brute-Force
🇦🇹
AustrianSimon
2026-05-09 08:53:12
(5 months ago)
09 May 2026 08:53:11UTC:Distributed Brute Force Password Attack (smtp, ftp, imap, pop, ssh) includin ...
show more
09 May 2026 08:53:11UTC:Distributed Brute Force Password Attack (smtp, ftp, imap, pop, ssh) including ip address 186.96.198.111
show less
Brute-Force
🇩🇪
FeG Deutschland
2026-05-09 02:08:08
(5 months ago)
Mail: - login with unknown user - bruteforce
Brute-Force