🇺🇸
TPI-Abuse
2026-11-08 12:01:30
UTC ·
(8 hours ago)
(mod_security) mod_security (id:210350) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 07:01:26.949358 2026] [security2:error] [pid 10519:tid 10519] [client 213.108.0.43:50907] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 07:01:26.949358 2026] [security2:error] [pid 10519:tid 10519] [client 213.108.0.43:50907] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.scoutinsignia.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.scoutinsignia.com"] [uri "/faq/faq16.htm"] [unique_id "avBkloy9D5DO_FNdtE5AmgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 23:00:20
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:00:03.972435 2026] [security2:error] [pid 23718:tid 23718] [client 213.108.0.43:50277] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:00:03.972435 2026] [security2:error] [pid 23718:tid 23718] [client 213.108.0.43:50277] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.instituteofscience.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.instituteofscience.com"] [uri "/AUTOMED/40R3.HTM"] [unique_id "au5b8-gdSJWwI4JSK-Eg9QAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 18:52:27
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 13:52:24.265123 2026] [security2:error] [pid 3141:tid 3141] [client 213.108.0.43:48895] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 13:52:24.265123 2026] [security2:error] [pid 3141:tid 3141] [client 213.108.0.43:48895] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||passwordresearch.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "passwordresearch.com"] [uri "/stats/statistic354.html"] [unique_id "auzQaHrGYe793R7l0cd96AAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 04:18:10
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 00:18:07.433745 2026] [security2:error] [pid 16245:tid 16288] [client 213.108.0.43:39375] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 00:18:07.433745 2026] [security2:error] [pid 16245:tid 16288] [client 213.108.0.43:39375] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.munatseng.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.munatseng.org"] [uri "/"] [unique_id "auQaf-MUqOL8EMLlKJTmqQAAAJE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 11:26:40
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 07:26:36.490089 2026] [security2:error] [pid 5390:tid 5422] [client 213.108.0.43:55923] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 07:26:36.490089 2026] [security2:error] [pid 5390:tid 5422] [client 213.108.0.43:55923] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||businesscertification.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "businesscertification.org"] [uri "/Awards.html"] [unique_id "at847ANjgpWd-00lHofTpQAAARc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nationaleventpros.com
2026-07-28 19:56:55
UTC ·
(3 months ago)
WordPress login attempt
Brute-Force
🇺🇸
TPI-Abuse
2026-07-16 16:46:32
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 12:46:21.609190 2026] [security2:error] [pid 31730:tid 31730] [client 213.108.0.43:51263] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 12:46:21.609190 2026] [security2:error] [pid 31730:tid 31730] [client 213.108.0.43:51263] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||refreshmc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "refreshmc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alkK3bMI8-g3ZQc1bOeJvgAAAD8"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
DRI
2026-07-16 16:33:36
UTC ·
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇺🇸
TPI-Abuse
2026-07-11 14:46:34
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 10:46:27.968818 2026] [security2:error] [pid 20857:tid 20857] [client 213.108.0.43:22413] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 10:46:27.968818 2026] [security2:error] [pid 20857:tid 20857] [client 213.108.0.43:22413] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||holtzheimer.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "holtzheimer.net"] [uri "/wp-json/wp/v2/users"] [unique_id "alJXQ7SJ8jUS6-5XLveNkAAAABc"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nationaleventpros.com
2026-06-14 19:56:40
UTC ·
(4 months ago)
WordPress login attempt
Brute-Force
🇺🇸
TPI-Abuse
2026-06-11 12:20:29
UTC ·
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 08:20:23.456885 2026] [security2:error] [pid 23825:tid 23825] [client 213.108.0.43:40109] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 213.108.0.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 08:20:23.456885 2026] [security2:error] [pid 23825:tid 23825] [client 213.108.0.43:40109] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jimhake.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jimhake.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiqoB7zXMBtAvCcocmu-NQAAAAY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇳
Altis Shield
2025-12-01 09:46:34
UTC ·
(11 months ago)
UDP flood/amplification attempt srcport 35262 dstport 1900 length 162
Fraud Orders
Bad Web Bot
2025-04-24 13:02:20
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-04-17 10:00:00
UTC ·
(1 year ago)
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ...
show more
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user”
show less
Hacking
Brute-Force
Web App Attack
2025-04-17 10:00:00
UTC ·
(1 year ago)
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ...
show more
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user “
show less
Hacking
Brute-Force
Web App Attack
