🇺🇸
TPI-Abuse
2026-11-14 17:36:46
UTC ·
(3 hours ago)
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 12:36:33.573436 2026] [security2:error] [pid 20850:tid 20850] [client 213.232.122.53:23181] ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 12:36:33.573436 2026] [security2:error] [pid 20850:tid 20850] [client 213.232.122.53:23181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||wea-inc.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "wea-inc.com"] [uri "/ITT_Rep/gouldspump.htm"] [unique_id "avicIaQRshlF1hGBteeHeQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 17:34:30
UTC ·
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 12:34:13.352949 2026] [security2:error] [pid 24568:tid 24568] [client 213.232.122.53:59831] ...
show more
(mod_security) mod_security (id:225170) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 12:34:13.352949 2026] [security2:error] [pid 24568:tid 24568] [client 213.232.122.53:59831] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||arsenalfordemocracy.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/users/14"] [unique_id "avCylRoYJZa-lPDu86EkqAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 19:08:47
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 14:08:34.144711 2026] [security2:error] [pid 32750:tid 32750] [client 213.232.122.53:18739] ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 14:08:34.144711 2026] [security2:error] [pid 32750:tid 32750] [client 213.232.122.53:18739] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.uphillfarmvt.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.uphillfarmvt.com"] [uri "/about/"] [unique_id "au4lsnX5ntAg_5anMqwHTwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 08:22:18
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:22:00.563275 2026] [security2:error] [pid 11279:tid 11293] [client 213.232.122.53:17443] ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:22:00.563275 2026] [security2:error] [pid 11279:tid 11293] [client 213.232.122.53:17443] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.tkfay.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.tkfay.com"] [uri "/ideas/from-the-heart/"] [unique_id "aumZqPjk4FnpUh2VIEahfAAAAUI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 02:56:57
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 22:56:44.801419 2026] [security2:error] [pid 27958:tid 27958] [client 213.232.122.53:21641] ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 22:56:44.801419 2026] [security2:error] [pid 27958:tid 27958] [client 213.232.122.53:21641] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2015/08/27/are-trumps-bankruptcies-worse-than-other-business-law-manipulations/"] [unique_id "auaqbKz9y4Dc1_xmvWp4nQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 08:57:04
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 04:56:58.396523 2026] [security2:error] [pid 5139:tid 5139] [client 213.232.122.53:10969] M ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 04:56:58.396523 2026] [security2:error] [pid 5139:tid 5139] [client 213.232.122.53:10969] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.avaliantlife.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.avaliantlife.com"] [uri "/ravi-zacharias-banner-avl/"] [unique_id "auRb2lE_DHYSqorLItb0cgAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 02:04:49
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 22:04:32.987281 2026] [security2:error] [pid 17788:tid 17820] [client 213.232.122.53:32509] ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 22:04:32.987281 2026] [security2:error] [pid 17788:tid 17820] [client 213.232.122.53:32509] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||charteredeconomist.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "charteredeconomist.com"] [uri "/"] [unique_id "auP7MO1ExLJ6kxT1hqApWAAAAFU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 11:44:07
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 07:43:49.877703 2026] [security2:error] [pid 4631:tid 4631] [client 213.232.122.53:9781] Mo ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 07:43:49.877703 2026] [security2:error] [pid 4631:tid 4631] [client 213.232.122.53:9781] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||whatcausesmentalillness.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "whatcausesmentalillness.com"] [uri "/glimpses-real-life-experiences-with-mental-illness/lived-experience/glimpses-1-real-life-experiences-of-mental-illness/ela-simons-carer-story"] [unique_id "at3rdcmVDzYMKx1B3wSM5wAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 03:14:45
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 23:14:31.304067 2026] [security2:error] [pid 29500:tid 29500] [client 213.232.122.53:51017] ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 23:14:31.304067 2026] [security2:error] [pid 29500:tid 29500] [client 213.232.122.53:51017] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ricketyshack.ca|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ricketyshack.ca"] [uri "/posts/"] [unique_id "atwilwVJbEqe9vo3yNMapwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 13:50:05
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 09:49:47.084384 2026] [security2:error] [pid 7529:tid 7529] [client 213.232.122.53:47683] M ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 09:49:47.084384 2026] [security2:error] [pid 7529:tid 7529] [client 213.232.122.53:47683] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.moleculardetective.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.moleculardetective.org"] [uri "/Links.html"] [unique_id "attl-4M-UHj67__0p_uAdgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 14:16:36
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:16:21.437372 2026] [security2:error] [pid 29953:tid 29953] [client 213.232.122.53:33755] ...
show more
(mod_security) mod_security (id:210350) triggered by 213.232.122.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:16:21.437372 2026] [security2:error] [pid 29953:tid 29953] [client 213.232.122.53:33755] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||katisfaction.nl|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "katisfaction.nl"] [uri "/rates.html"] [unique_id "atDgNeQgzd6CDYPU97_SYQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2026-10-12 10:00:02
UTC ·
(1 month ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 213.232.122.53 (RU/Russia/-)
Bad Web Bot
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇭
SOC [GOLINE SA]
2026-09-09 02:10:39
UTC ·
(2 months ago)
[RoutePulse | 2026-09-09T02:10:39Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 213.232.122.53 · AS59651 Alex Largman · Russia
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed attack (3 at ...
show more
[RoutePulse | 2026-09-09T02:10:39Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 213.232.122.53 · AS59651 Alex Largman · Russia
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed attack (3 attempts/15min) — shun on the VPN gateway
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
Brute-Force
Hacking
🇨🇿
lp
2026-09-08 16:50:01
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 14 attempts were recorded from 213.232.122.53
2026-09-08T18:25:29+02:00 vpn Access-Reject 'teeway' station: 213.232.122.53 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redac ...
show more
Unauthorized VPN login attempts: 14 attempts were recorded from 213.232.122.53
2026-09-08T18:25:29+02:00 vpn Access-Reject 'teeway' station: 213.232.122.53 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-08T18:26:49+02:00 vpn Access-Reject 'operator' station: 213.232.122.53 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-08T18:28:11+02:00 vpn Access-Reject 'ftpuser2' station: 213.232.122.53 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-08T18:29:34+02:00 vpn Access-Reject 'adeelsaeedi' station: 213.232.122.53 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-08T18:30:55+02:00 vpn Access-Reject 'ramzy' station: 213.232.122.53 auth-type: - realm: vse.cz
show less
Brute-Force
Web App Attack
