🇺🇸
TPI-Abuse
2026-11-10 00:56:35
UTC ·
(9 hours ago)
(mod_security) mod_security (id:210350) triggered by 31.134.0.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:56:29.506940 2026] [security2:error] [pid 31352:tid 31352] [client 31.134.0.47:24273] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.0.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:56:29.506940 2026] [security2:error] [pid 31352:tid 31352] [client 31.134.0.47:24273] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cbcfargo.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cbcfargo.com"] [uri "/site/Resources/devotionals/2025-01-05.php"] [unique_id "avJrvTCESXZiVLBYpNqc9QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 15:08:18
UTC ·
(19 hours ago)
(mod_security) mod_security (id:210350) triggered by 31.134.0.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 10:08:12.404002 2026] [security2:error] [pid 30567:tid 30567] [client 31.134.0.47:31635] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.0.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 10:08:12.404002 2026] [security2:error] [pid 30567:tid 30567] [client 31.134.0.47:31635] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||naacd.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "naacd.com"] [uri "/blog/2008/07/choosing-booze-or-church.html"] [unique_id "avHh3Keie45XcZg478XquAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 13:45:47
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 31.134.0.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:45:44.407826 2026] [security2:error] [pid 16553:tid 16553] [client 31.134.0.47:27503] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.0.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:45:44.407826 2026] [security2:error] [pid 16553:tid 16553] [client 31.134.0.47:27503] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.painting-with-numbers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.painting-with-numbers.com"] [uri "/blog/proving-uncle-sam-actually-fires-employees"] [unique_id "avB9CBHf1PJJvACIEK9NowAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 13:15:47
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 31.134.0.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:15:42.280753 2026] [security2:error] [pid 22762:tid 22762] [client 31.134.0.47:40893] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.0.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:15:42.280753 2026] [security2:error] [pid 22762:tid 22762] [client 31.134.0.47:40893] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.informant-systems.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.informant-systems.com"] [uri "/cgi-bin/poll/poll.cgi"] [unique_id "avB1_u6SaVUniO3Pw9F_ngAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 04:47:17
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 31.134.0.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 23:47:12.064846 2026] [security2:error] [pid 24730:tid 24730] [client 31.134.0.47:13429] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.0.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 23:47:12.064846 2026] [security2:error] [pid 24730:tid 24730] [client 31.134.0.47:13429] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arapi.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arapi.org"] [uri "/glass-windows-antivirus/"] [unique_id "aulnUAqFd1KNymjT8Cdi0QAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 18:57:42
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 31.134.0.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:57:38.758635 2026] [security2:error] [pid 24270:tid 24270] [client 31.134.0.47:54489] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.0.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:57:38.758635 2026] [security2:error] [pid 24270:tid 24270] [client 31.134.0.47:54489] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.seizetheseason.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.seizetheseason.com"] [uri "/genealogy/ajpfam.htm"] [unique_id "auJFoty1kBc7idCE0mf-RgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-15 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-14 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
2026-01-27 20:17:08
UTC ·
(9 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2026.01.27 is noted in report timestamp
Hacking
Brute-Force
2025-12-17 21:20:47
UTC ·
(10 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.12.17 is noted in report timestamp
Hacking
Brute-Force
🇺🇸
fbarela
2025-12-12 02:00:22
UTC ·
(10 months ago)
FortiGate SSL VPN login failures.
Hacking
Brute-Force
2025-12-01 16:03:17
UTC ·
(11 months ago)
IM360 WAF: Attempt to upload malware
Hacking
2025-11-27 18:03:00
UTC ·
(11 months ago)
IM360 WAF: Attempt to upload malware
Hacking
2025-10-28 08:37:47
UTC ·
(1 year ago)
IM360 WAF: Attempt to upload malware
Hacking
2025-06-24 12:58:00
UTC ·
(1 year ago)
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-06-24 time=07:18:47 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1750767527406309818 tz="-0500" logid="0101039426" type="even ...
show more
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-06-24 time=07:18:47 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1750767527406309818 tz="-0500" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=31.134.0.47 srccountry="United States" user="cmiller" group="N/A" dst_host="N/A" reason="sslvpn_login_unknown_user" msg="SSL user failed to logged in"
show less
VPN IP
