🇺🇸
TPI-Abuse
2026-11-10 15:59:43
UTC ·
(7 hours ago)
(mod_security) mod_security (id:210350) triggered by 199.96.165.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:59:38.820374 2026] [security2:error] [pid 5414:tid 5414] [client 199.96.165.154:31397] M ...
show more
(mod_security) mod_security (id:210350) triggered by 199.96.165.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:59:38.820374 2026] [security2:error] [pid 5414:tid 5414] [client 199.96.165.154:31397] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2014/08/02/new-york-speculators-are-forcing-an-argentina-default-1780s-style/"] [unique_id "avM_alEoToHVxKkJeClHQgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-10 12:00:14
UTC ·
(11 hours ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-10-31 02:57:45
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 199.96.165.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 22:57:38.320130 2026] [security2:error] [pid 26563:tid 26563] [client 199.96.165.154:21753] ...
show more
(mod_security) mod_security (id:210350) triggered by 199.96.165.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 22:57:38.320130 2026] [security2:error] [pid 26563:tid 26563] [client 199.96.165.154:21753] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ideaofauniversity.website|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ideaofauniversity.website"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "auVZIt0vpDQshV9TCrz9GgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 00:49:28
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 199.96.165.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 20:49:23.172879 2026] [security2:error] [pid 27900:tid 27900] [client 199.96.165.154:41467] ...
show more
(mod_security) mod_security (id:210350) triggered by 199.96.165.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 20:49:23.172879 2026] [security2:error] [pid 27900:tid 27900] [client 199.96.165.154:41467] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.jerusalem-korczak-home.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.jerusalem-korczak-home.com"] [uri "/kk/r/kuch2.htm"] [unique_id "auFGkyORW74RywRvM8To3gAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 18:27:49
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 199.96.165.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 14:27:44.297591 2026] [security2:error] [pid 24639:tid 24639] [client 199.96.165.154:56943] ...
show more
(mod_security) mod_security (id:210350) triggered by 199.96.165.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 14:27:44.297591 2026] [security2:error] [pid 24639:tid 24639] [client 199.96.165.154:56943] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.alexgitlin.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.alexgitlin.com"] [uri "/npp/rs.htm"] [unique_id "at-boJSg-4vdAqp5eiWsMQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
antihack.anarchista.xyz
2026-02-06 18:12:46
UTC ·
(9 months ago)
Brute-force login: 7 fails in 10 min, last user "headhardkorer", URI /xmlrpc.php, UA curl/8.6.0
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mind5t0rm
2026-02-06 13:25:06
UTC ·
(9 months ago)
(XMLRPC) WP XMLPRC Attack 199.96.165.154 (US/United States/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 199.96.165.154 - - [06/Feb/2026:20:25:02 +0700] "POST /xmlrpc.php HTTP/2.0" 403 154 "-" "curl/8.6.0"
199.96 ...
show more
(XMLRPC) WP XMLPRC Attack 199.96.165.154 (US/United States/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 199.96.165.154 - - [06/Feb/2026:20:25:02 +0700] "POST /xmlrpc.php HTTP/2.0" 403 154 "-" "curl/8.6.0"
199.96.165.154 - - [06/Feb/2026:20:25:03 +0700] "POST /xmlrpc.php HTTP/2.0" 403 154 "-" "curl/7.88.1"
199.96.165.154 - - [06/Feb/2026:20:25:05 +0700] "POST /xmlrpc.php HTTP/2.0" 403 154 "-" "Wget/1.21.4"
show less
Port Scan
2026-01-28 04:22:43
UTC ·
(9 months ago)
Attempted brute force login to web vpn 2 time(s); last attempt for 2026.01.28 is noted in report timestamp
Hacking
Brute-Force
2026-01-17 12:19:08
UTC ·
(9 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2026.01.17 is noted in report timestamp
Hacking
Brute-Force
🇫🇷
masterguru
2025-12-23 11:03:40
UTC ·
(10 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 199.96.165.154 (US/United States/-): 1 in the last 3600 secs (0-197)
Hacking
🇺🇸
fbarela
2025-11-14 11:00:01
UTC ·
(11 months ago)
FortiGate SSL VPN login failures.
Hacking
Brute-Force
🇨🇭
backslash
2025-11-12 01:10:41
UTC ·
(11 months ago)
block ruleset 798ECF92F12ADC636D3520C2890AF17ADEFDE3BE
Bad Web Bot
2025-10-28 23:14:44
UTC ·
(1 year ago)
Forum/form spam
Web Spam
2025-10-22 21:03:18
UTC ·
(1 year ago)
IM360 WAF: Attempt to upload malware
Hacking
2025-08-25 00:44:44
UTC ·
(1 year ago)
2025-08-25T02:44:44.246319+02:00 zanati wp(www.sahpa.co.za)[3514732]: Blocked authentication attempt for
[email protected] from 199.96.165.154
...
Web App Attack
