🇺🇸
TPI-Abuse
2026-11-15 04:29:33
UTC ·
(12 minutes ago)
(mod_security) mod_security (id:210350) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 23:29:29.130581 2026] [security2:error] [pid 6040:tid 6040] [client 45.133.115.98:60283] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 23:29:29.130581 2026] [security2:error] [pid 6040:tid 6040] [client 45.133.115.98:60283] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||vitality-web.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "vitality-web.com"] [uri "/Human-Touch-Perfect-Chair-Recliner/Human-Touch-PC-420-Manual-Perfect-Chair-Recliner-Black-Leather-Walnut-Wood.htm"] [unique_id "avk1KUDJMP39znJSE6a37wAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 09:46:57
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:46:50.197175 2026] [security2:error] [pid 19429:tid 19429] [client 45.133.115.98:38261] M ...
show more
(mod_security) mod_security (id:210350) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:46:50.197175 2026] [security2:error] [pid 19429:tid 19429] [client 45.133.115.98:38261] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2013/12/02/france-back-africa/"] [unique_id "avbcir9ZuydSb-F__fnQiwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 10:58:40
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:58:35.320654 2026] [security2:error] [pid 5175:tid 5175] [client 45.133.115.98:47607] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:58:35.320654 2026] [security2:error] [pid 5175:tid 5175] [client 45.133.115.98:47607] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||tobyjohnson.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "tobyjohnson.com"] [uri "/review-lovestar-aids-shaman.html"] [unique_id "avL423nUH_Gk9jSD7XzonwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 03:20:44
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 23:20:39.504474 2026] [security2:error] [pid 27284:tid 27284] [client 45.133.115.98:48831] M ...
show more
(mod_security) mod_security (id:210350) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 23:20:39.504474 2026] [security2:error] [pid 27284:tid 27284] [client 45.133.115.98:48831] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/tag/frank-church/"] [unique_id "auVeh478x3kF9MLCcwBK3AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 10:17:14
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 06:17:10.954581 2026] [security2:error] [pid 23447:tid 23447] [client 45.133.115.98:44351] M ...
show more
(mod_security) mod_security (id:210350) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 06:17:10.954581 2026] [security2:error] [pid 23447:tid 23447] [client 45.133.115.98:44351] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.calvarycavaliers.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.calvarycavaliers.org"] [uri "/cbea/"] [unique_id "auRupniSp0uKEIQylI79wwAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-10-07 08:21:00
UTC ·
(1 month ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-04 08:43:06
UTC ·
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 04 04:43:01.767073 2026] [security2:error] [pid 1312694:tid 1312779] [client 45.133.115.98:5430 ...
show more
(mod_security) mod_security (id:210730) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 04 04:43:01.767073 2026] [security2:error] [pid 1312694:tid 1312779] [client 45.133.115.98:54309] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||montanatribes.org|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "montanatribes.org"] [uri "/backup_2024.db"] [unique_id "anGmFdgAzjSZIAatdMZ6SQAAAQk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 22:39:15
UTC ·
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 18:39:10.127546 2026] [security2:error] [pid 3589:tid 3589] [client 45.133.115.98:41713] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 18:39:10.127546 2026] [security2:error] [pid 3589:tid 3589] [client 45.133.115.98:41713] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||n3fjp.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "n3fjp.com"] [uri "/n3fjp.com.sql"] [unique_id "amPpjq2mfglmDidC1GYEDQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-20 23:41:20
UTC ·
(1 year ago)
(mod_security) mod_security (id:210831) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 20 19:41:16.105116 2025] [security2:error] [pid 6587:tid 6587] [client 45.133.115.98:26681] Mod ...
show more
(mod_security) mod_security (id:210831) triggered by 45.133.115.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 20 19:41:16.105116 2025] [security2:error] [pid 6587:tid 6587] [client 45.133.115.98:26681] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||backstore.com|F|4"] [data "a href="] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "backstore.com"] [uri "/webalizer/"] [unique_id "aKZdHPcfPUo8Qf77-_VMYQAAACM"], referer: http://backstore.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-07-10 11:07:00
UTC ·
(1 year ago)
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-07-10 time=00:43:22 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1752126202334973607 tz="-0500" logid="0101039426" type="even ...
show more
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-07-10 time=00:43:22 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1752126202334973607 tz="-0500" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=45.133.115.98 srccountry="United States" user="ricoh" group="N/A" dst_host="N/A" reason="sslvpn_login_unknown_user" msg="SSL user failed to logged in"
show less
VPN IP
2025-06-25 12:25:00
UTC ·
(1 year ago)
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-06-24 time=19:39:39 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1750811979714913818 tz="-0500" logid="0101039426" type="even ...
show more
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-06-24 time=19:39:39 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1750811979714913818 tz="-0500" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=45.133.115.98 srccountry="United States" user="tech" group="N/A" dst_host="N/A" reason="sslvpn_login_unknown_user" msg="SSL user failed to logged in"
show less
VPN IP
