🇺🇸
TPI-Abuse
2026-11-15 15:07:38
UTC ·
(4 hours ago)
(mod_security) mod_security (id:210350) triggered by 213.232.120.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 10:07:21.129284 2026] [security2:error] [pid 4269:tid 4269] [client 213.232.120.31:47771] M ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.120.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 10:07:21.129284 2026] [security2:error] [pid 4269:tid 4269] [client 213.232.120.31:47771] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.caferutadelaseda.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.caferutadelaseda.com"] [uri "/images/lib/lib/assets/owlcarousel/source/helpers/jquery.fancybox-media.js"] [unique_id "avnKqQ19OEq9Mkk2dzoTvAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 17:28:14
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 213.232.120.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 12:27:57.427093 2026] [security2:error] [pid 20106:tid 20106] [client 213.232.120.31:23611] ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.120.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 12:27:57.427093 2026] [security2:error] [pid 20106:tid 20106] [client 213.232.120.31:23611] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.quakeprediction.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.quakeprediction.com"] [uri "/Niigata Japan Earthquake Forecast.html"] [unique_id "avdIndVBPFh6PC88bfB0vAAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 17:43:38
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 213.232.120.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 12:43:25.353918 2026] [security2:error] [pid 3704:tid 3704] [client 213.232.120.31:16991] M ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.120.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 12:43:25.353918 2026] [security2:error] [pid 3704:tid 3704] [client 213.232.120.31:16991] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.tankercontrol.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.tankercontrol.com"] [uri "/12-solution-benefits/00-solution-benefits.htm"] [unique_id "avC0vavVqEzxQErDz79JLAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 11:39:07
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 213.232.120.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 06:38:49.748934 2026] [security2:error] [pid 22599:tid 22599] [client 213.232.120.31:46743] ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.120.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 06:38:49.748934 2026] [security2:error] [pid 22599:tid 22599] [client 213.232.120.31:46743] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.watonga.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.watonga.com"] [uri "/biblebios/lot/trans-julia-kolucci/"] [unique_id "avBfSVX0_UtZPmuRhxkLCQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-15 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-14 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-08 18:21:31
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 213.232.120.31
2026-09-08T19:38:58+02:00 vpn Access-Reject 'aviva' station: 213.232.120.31 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacte ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 213.232.120.31
2026-09-08T19:38:58+02:00 vpn Access-Reject 'aviva' station: 213.232.120.31 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇦
DRI
2026-07-31 11:46:38
UTC ·
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇨🇭
backslash
2026-07-30 01:27:00
UTC ·
(3 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-29 19:51:06
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 213.232.120.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 15:50:52.577330 2026] [security2:error] [pid 207802:tid 207802] [client 213.232.120.31:4602 ...
show more
(mod_security) mod_security (id:225170) triggered by 213.232.120.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 15:50:52.577330 2026] [security2:error] [pid 207802:tid 207802] [client 213.232.120.31:46023] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||churchtop.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "churchtop.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ampZnAYIqb7_BwJ7tQMyLgAAAA8"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
DRI
2026-07-28 11:33:02
UTC ·
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇨🇿
ptlab
2026-07-19 06:45:27
UTC ·
(3 months ago)
Detected wp_login attack from WP-host.
Hacking
Web App Attack
🇺🇸
ambor
2026-07-19 03:26:54
UTC ·
(3 months ago)
Honeypot access: WordPress admin access attempt. Path: /wp-login.php
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-14 17:14:41
UTC ·
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 213.232.120.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 13:14:25.817973 2026] [security2:error] [pid 3524:tid 3524] [client 213.232.120.31:43113] M ...
show more
(mod_security) mod_security (id:225170) triggered by 213.232.120.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 13:14:25.817973 2026] [security2:error] [pid 3524:tid 3524] [client 213.232.120.31:43113] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||aeongames.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aeongames.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alZuccHRagUlDL73xFC-FQAAABQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
clauss
2026-07-14 05:50:57
UTC ·
(4 months ago)
IP reached maximum auth failures for a one day block
Brute-Force
