🇺🇸
TPI-Abuse
2026-11-14 07:16:17
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 02:16:13.020979 2026] [security2:error] [pid 31578:tid 31578] [client 193.202.8.89:9963] ModS ...
show more
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 02:16:13.020979 2026] [security2:error] [pid 31578:tid 31578] [client 193.202.8.89:9963] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.watonga.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.watonga.com"] [uri "/biblebios/lot/altheim-massage/"] [unique_id "avgKveUrokdZa-F2YoMiXwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
librebit
2026-11-13 07:17:13
UTC ·
(2 days ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-11-10 09:36:21
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:36:14.964910 2026] [security2:error] [pid 17497:tid 17497] [client 193.202.8.89:48991] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:36:14.964910 2026] [security2:error] [pid 17497:tid 17497] [client 193.202.8.89:48991] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.fgrotary.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fgrotary.org"] [uri "/uncategorized/congratulations-to-our-january-youth-citizens-of-the-month/"] [unique_id "avLljl8fJOzheSUO-nabHQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 01:12:12
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 20:12:07.918759 2026] [security2:error] [pid 30987:tid 30987] [client 193.202.8.89:19373] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 20:12:07.918759 2026] [security2:error] [pid 30987:tid 30987] [client 193.202.8.89:19373] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||phantomkennels.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "phantomkennels.com"] [uri "/rebelransom.html"] [unique_id "avEd505C0hXtq0E_TGWvcQAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-08 01:43:42
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇺🇸
Zandro
2026-11-02 04:00:14
UTC ·
(1 week ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-10-28 23:01:35
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 19:01:30.003593 2026] [security2:error] [pid 18659:tid 18659] [client 193.202.8.89:42143] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 19:01:30.003593 2026] [security2:error] [pid 18659:tid 18659] [client 193.202.8.89:42143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.limocorpuschristi.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.limocorpuschristi.com"] [uri "/florists.html"] [unique_id "auJ-yiXvYxN0xf0Eeyw8nAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 13:10:26
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 09:10:19.647751 2026] [security2:error] [pid 23891:tid 23891] [client 193.202.8.89:13253] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 09:10:19.647751 2026] [security2:error] [pid 23891:tid 23891] [client 193.202.8.89:13253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.joshuashands.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.joshuashands.org"] [uri "/joshuashands.org/News/Entries/2012/6/8_Scholarships_Awarded.html"] [unique_id "auH0O8_V8ktQeO14JD0uDwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 12:21:08
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 08:21:02.176951 2026] [security2:error] [pid 7607:tid 7607] [client 193.202.8.89:24523] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 08:21:02.176951 2026] [security2:error] [pid 7607:tid 7607] [client 193.202.8.89:24523] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||iheldt.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "iheldt.net"] [uri "/docs/lyrics/violets.htm"] [unique_id "auHork8mmy-sSwiIARoXCgAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-27 04:44:45
UTC ·
(2 weeks ago)
Banned by Fail2Ban on server
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 04:56:42
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 00:56:34.246001 2026] [security2:error] [pid 11246:tid 11285] [client 193.202.8.89:53331] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 00:56:34.246001 2026] [security2:error] [pid 11246:tid 11285] [client 193.202.8.89:53331] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.aafmgcc.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.aafmgcc.com"] [uri "/requirements.html"] [unique_id "atw6giOEM14RsGONLDn9-wAAAEU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 13:56:56
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:55:22.398906 2026] [security2:error] [pid 5629:tid 5629] [client 193.202.8.89:48183] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 193.202.8.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:55:22.398906 2026] [security2:error] [pid 5629:tid 5629] [client 193.202.8.89:48183] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.powerkiteforum.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.powerkiteforum.com"] [uri "/viewthread.php"] [unique_id "atDbStqFJ5L_49lIA6aLAgAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-15 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-14 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-10 01:51:37
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 193.202.8.89
2026-09-10T02:20:36+02:00 vpn Access-Reject 'teleco1004487488' station: 193.202.8.89 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '< ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 193.202.8.89
2026-09-10T02:20:36+02:00 vpn Access-Reject 'teleco1004487488' station: 193.202.8.89 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
