🇺🇸
TPI-Abuse
2026-11-08 19:25:54
UTC ·
(9 hours ago)
(mod_security) mod_security (id:210350) triggered by 31.40.195.224 (its-smart-slewing.verticloth.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:25:48.331225 2026] [security2:error] [pid 12086:tid 12086] ...
show more
(mod_security) mod_security (id:210350) triggered by 31.40.195.224 (its-smart-slewing.verticloth.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:25:48.331225 2026] [security2:error] [pid 12086:tid 12086] [client 31.40.195.224:57985] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bostonlog.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bostonlog.com"] [uri "/2009-run-with-endurance-the-race-set-before-us/"] [unique_id "avDMvDblDRmZjKia04EJFwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 15:16:01
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 31.40.195.224 (its-smart-slewing.verticloth.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 10:15:56.240966 2026] [security2:error] [pid 23022:tid 23022] ...
show more
(mod_security) mod_security (id:210350) triggered by 31.40.195.224 (its-smart-slewing.verticloth.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 10:15:56.240966 2026] [security2:error] [pid 23022:tid 23022] [client 31.40.195.224:50203] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lightningbug.farm|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lightningbug.farm"] [uri "/wp-json/wp/v2/categories/6"] [unique_id "au3vLHCXTyBvWW4iYkjRKwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 12:44:12
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 31.40.195.224 (its-smart-slewing.verticloth.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 07:44:06.011057 2026] [security2:error] [pid 11815:tid 11815] ...
show more
(mod_security) mod_security (id:210350) triggered by 31.40.195.224 (its-smart-slewing.verticloth.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 07:44:06.011057 2026] [security2:error] [pid 11815:tid 11815] [client 31.40.195.224:58145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||edenberg.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "edenberg.com"] [uri "/training-and-technology.html"] [unique_id "aux6Fo_-xd3xzLX7o5rb0AAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 13:03:13
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 31.40.195.224 (its-smart-slewing.verticloth.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 09:03:10.284924 2026] [security2:error] [pid 29638:tid 29638] ...
show more
(mod_security) mod_security (id:210350) triggered by 31.40.195.224 (its-smart-slewing.verticloth.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 09:03:10.284924 2026] [security2:error] [pid 29638:tid 29638] [client 31.40.195.224:42509] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/tags/327"] [unique_id "auSVjnjuKqGbcCzlfoe9dgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
lp
2026-09-13 01:51:13
UTC ·
(1 month ago)
Unauthorized VPN login attempts: 2 attempts were recorded from 31.40.195.224
2026-09-13T03:13:18+02:00 vpn Access-Reject 'aswanth' station: 31.40.195.224 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacte ...
show more
Unauthorized VPN login attempts: 2 attempts were recorded from 31.40.195.224
2026-09-13T03:13:18+02:00 vpn Access-Reject 'aswanth' station: 31.40.195.224 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-13T03:14:41+02:00 vpn Access-Reject 'ashwin.s' station: 31.40.195.224 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-07-03 07:15:16
UTC ·
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 31.40.195.224 (its-smart-slewing.verticloth.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 03:15:08.547075 2026] [security2:error] [pid 5239:tid 5239] [ ...
show more
(mod_security) mod_security (id:225170) triggered by 31.40.195.224 (its-smart-slewing.verticloth.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 03:15:08.547075 2026] [security2:error] [pid 5239:tid 5239] [client 31.40.195.224:54369] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||shelbysmoak.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "shelbysmoak.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akdhfAUFgnwZJ3HHx1wMfAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-01-28 15:52:35
UTC ·
(9 months ago)
"POST /xmlrpc.php HTTP/1.1"
Hacking
Web App Attack
🇩🇪
Packets-Decreaser.NET
2025-12-29 13:06:09
UTC ·
(10 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
nowyouknow
2025-12-19 01:25:15
UTC ·
(10 months ago)
(From [email protected] ) Hello Team,
I typed your main service keywords into Google today, and I noticed something frustrating. Your website is professionally designed, but it’s buried on Page 2.
Meanwhile, 2 or 3 of your direct competi ...
show more
(From [email protected] ) Hello Team,
I typed your main service keywords into Google today, and I noticed something frustrating. Your website is professionally designed, but it’s buried on Page 2.
Meanwhile, 2 or 3 of your direct competitors, who frankly have weaker websites than you—are sitting at the top of Page 1.
They are effectively "stealing" leads that were looking for you. They aren't better than you; they just have better SEO signals.
I’ve already analyzed exactly what they are doing differently.
If you want to see the comparison report, just reply "Yes" and I’ll send it over.
Cheers,
QIK
show less
Phishing
Web Spam
2025-09-27 18:55:51
UTC ·
(1 year ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
2025-09-26 12:21:10
UTC ·
(1 year ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
