🇺🇸
TPI-Abuse
2026-11-14 21:00:52
UTC ·
(17 hours ago)
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 16:00:44.576485 2026] [security2:error] [pid 5939:tid 5939] [client 194.180.232.31:52349] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 16:00:44.576485 2026] [security2:error] [pid 5939:tid 5939] [client 194.180.232.31:52349] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.mosherpit.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.mosherpit.com"] [uri "/2013/01/happy-new-year-2013-edition.html"] [unique_id "avjL_GWYFtdJFFpf-ff13QAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-12 20:00:14
UTC ·
(2 days ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-11 23:13:47
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:13:44.602256 2026] [security2:error] [pid 8304:tid 8304] [client 194.180.232.31:52441] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:13:44.602256 2026] [security2:error] [pid 8304:tid 8304] [client 194.180.232.31:52441] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||modmove.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "modmove.com"] [uri "/reviews/she-said-movie-review/"] [unique_id "avT2qBDGGuTvmbLBCLozkwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 20:45:15
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 15:45:12.339485 2026] [security2:error] [pid 22394:tid 22394] [client 194.180.232.31:28699] ...
show more
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 15:45:12.339485 2026] [security2:error] [pid 22394:tid 22394] [client 194.180.232.31:28699] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.alexgitlin.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.alexgitlin.com"] [uri "/sandy.htm"] [unique_id "avTT2GWbenZMdex2D4PoKgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 03:29:56
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:29:47.869048 2026] [security2:error] [pid 3626:tid 3626] [client 194.180.232.31:27751] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:29:47.869048 2026] [security2:error] [pid 3626:tid 3626] [client 194.180.232.31:27751] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2015/05/05/italys-pm-passes-brand-new-election-system-law/"] [unique_id "avKPq_SEOoLW7Va6ppmlNAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
abivia
2026-11-06 06:12:35
UTC ·
(1 week ago)
Abivia WAF trigger: Rule scriptKiddies: Probing for vulnerabilities uri: /oembed.php?url=https%3A%2F%2Fambitonline.com%2Fnextrelease%2F2025%2F08%2Fa-shout-out-for-celtic-brews-my-local-on-premise-brewery%2F&format=xml
Hacking
🇺🇸
TPI-Abuse
2026-11-05 02:08:20
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 21:08:16.632520 2026] [security2:error] [pid 22150:tid 22150] [client 194.180.232.31:12725] ...
show more
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 21:08:16.632520 2026] [security2:error] [pid 22150:tid 22150] [client 194.180.232.31:12725] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||phuket-boatcharter.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "phuket-boatcharter.com"] [uri "/join-in-cabin-charters-burma-thailand-share-a-yacht.htm"] [unique_id "auvlEAVLo0p3WZJyAp0_8AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 05:03:21
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 01:03:14.434495 2026] [security2:error] [pid 32505:tid 32505] [client 194.180.232.31:16773] ...
show more
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 01:03:14.434495 2026] [security2:error] [pid 32505:tid 32505] [client 194.180.232.31:16773] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||socialstudiesforkids.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "socialstudiesforkids.com"] [uri "/articles/ushistory/billofrights4.htm"] [unique_id "athHkndymomC8r4p9OM7bwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 13:55:10
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:54:38.921548 2026] [security2:error] [pid 25487:tid 25487] [client 194.180.232.31:34927] ...
show more
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:54:38.921548 2026] [security2:error] [pid 25487:tid 25487] [client 194.180.232.31:34927] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||modmove.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "modmove.com"] [uri "/tag/goma/"] [unique_id "atDbHoX0wPNDxsoZ2IOVYwAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 12:57:22
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 08:57:16.015045 2026] [security2:error] [pid 12556:tid 12556] [client 194.180.232.31:23607] ...
show more
(mod_security) mod_security (id:210350) triggered by 194.180.232.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 08:57:16.015045 2026] [security2:error] [pid 12556:tid 12556] [client 194.180.232.31:23607] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.spaceritual.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.spaceritual.net"] [uri "/tractor/cb-sonofdustsucker.htm"] [unique_id "atDNrLzTJqObxbWMaxRGmwAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
OnTheEdge
2026-09-14 09:26:09
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇸🇪
OnTheEdge
2026-09-14 09:26:09
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-11 01:50:57
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 3 attempts were recorded from 194.180.232.31
2026-09-11T02:54:13+02:00 vpn Access-Reject 'grspg03' station: 194.180.232.31 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redac ...
show more
Unauthorized VPN login attempts: 3 attempts were recorded from 194.180.232.31
2026-09-11T02:54:13+02:00 vpn Access-Reject 'grspg03' station: 194.180.232.31 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-11T02:55:36+02:00 vpn Access-Reject 'grspg04' station: 194.180.232.31 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-11T02:56:58+02:00 vpn Access-Reject 'grspg05' station: 194.180.232.31 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
