🇺🇸
TPI-Abuse
2026-11-15 17:08:11
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 12:08:06.931886 2026] [security2:error] [pid 23026:tid 23145] [client 91.132.124.12:54405] M ...
show more
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 12:08:06.931886 2026] [security2:error] [pid 23026:tid 23145] [client 91.132.124.12:54405] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.chelseyrae.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.chelseyrae.com"] [uri "/lifestyle/wedding-dress-shopping-at-linen-jolie/"] [unique_id "avnm9lMx64wEtElZb0BIyQAAAMo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 14:54:50
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 09:54:47.046173 2026] [security2:error] [pid 13113:tid 13216] [client 91.132.124.12:48583] M ...
show more
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 09:54:47.046173 2026] [security2:error] [pid 13113:tid 13216] [client 91.132.124.12:48583] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cargomarexpress.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cargomarexpress.com"] [uri "/product/hpassportlessi571907"] [unique_id "avh2N1n82gEySzpCGTllwAAAAhQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-14 04:00:14
UTC ·
(1 day ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-10 15:26:49
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:26:46.218728 2026] [security2:error] [pid 30279:tid 30279] [client 91.132.124.12:55747] M ...
show more
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:26:46.218728 2026] [security2:error] [pid 30279:tid 30279] [client 91.132.124.12:55747] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.esysapps.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.esysapps.com"] [uri "/uncategorized/how-to-chunk-files-for-a-rag-model-with-python-example/"] [unique_id "avM3tlcjI3gzE5rl7viSMgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 16:16:18
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 12:16:12.274054 2026] [security2:error] [pid 14465:tid 14465] [client 91.132.124.12:49095] M ...
show more
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 12:16:12.274054 2026] [security2:error] [pid 14465:tid 14465] [client 91.132.124.12:49095] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ricketyshack.ca|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ricketyshack.ca"] [uri "/web/"] [unique_id "auIfzJ33Hu_Rg-TDn0qdFAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 00:57:46
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 20:57:42.944549 2026] [security2:error] [pid 23891:tid 23891] [client 91.132.124.12:17491] M ...
show more
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 20:57:42.944549 2026] [security2:error] [pid 23891:tid 23891] [client 91.132.124.12:17491] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.catholicshopper.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.catholicshopper.com"] [uri "/products/bliss_patron_saint_medals_a.html"] [unique_id "at1UBh9jGryNK7-blPwtxAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 15:06:32
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 11:06:23.686819 2026] [security2:error] [pid 17534:tid 17534] [client 91.132.124.12:34869] M ...
show more
(mod_security) mod_security (id:210730) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 11:06:23.686819 2026] [security2:error] [pid 17534:tid 17534] [client 91.132.124.12:34869] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Barcalounger/Images/Briarwood II/Stetson Bordeaux/Thumbs.db"] [unique_id "asO87-IGcymNcO0b8jll_wAAABA"], referer: https://vitalitywebb.com/backstore/Barcalounger/Images/Briarwood%20II/Stetson%20Bordeaux/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-09-23 11:50:37
UTC ·
(1 month ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 91.132.124.12 (US/United States/-): 1 in the last 3600 secs (0-195)
Hacking
🇺🇸
TPI-Abuse
2026-06-14 00:52:39
UTC ·
(5 months ago)
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 20:52:35.219578 2026] [security2:error] [pid 14428:tid 14428] [client 91.132.124.12:43361] M ...
show more
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 20:52:35.219578 2026] [security2:error] [pid 14428:tid 14428] [client 91.132.124.12:43361] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||bvi-boat-registration.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bvi-boat-registration.com"] [uri "/adminer/adminer.php"] [unique_id "ai37U_iFq_LUXwVoXXlbcQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 21:05:12
UTC ·
(5 months ago)
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 17:05:08.919087 2026] [security2:error] [pid 23705:tid 23705] [client 91.132.124.12:49649] M ...
show more
(mod_security) mod_security (id:210350) triggered by 91.132.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 17:05:08.919087 2026] [security2:error] [pid 23705:tid 23705] [client 91.132.124.12:49649] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||hardcountryrock.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "hardcountryrock.com"] [uri "/_adminer.php"] [unique_id "ai3GBMa9vYZk0QCPPZv_bgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-04-16 15:27:04
UTC ·
(6 months ago)
block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8
Bad Web Bot
2026-01-21 13:51:00
UTC ·
(9 months ago)
Brute force on VPN
Brute-Force
Bad Web Bot
🇨🇭
backslash
2025-11-19 13:15:11
UTC ·
(11 months ago)
block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8
Bad Web Bot
🇩🇪
Packets-Decreaser.NET
2025-09-23 06:02:48
UTC ·
(1 year ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
2025-06-24 11:10:00
UTC ·
(1 year ago)
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-06-24 time=04:39:36 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1750757976023087186 tz="-0500" logid="0101039426" type="even ...
show more
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-06-24 time=04:39:36 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1750757976023087186 tz="-0500" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=91.132.124.12 srccountry="United States" user="vbrown" group="N/A" dst_host="N/A" reason="sslvpn_login_unknown_user" msg="SSL user failed to logged in"
show less
VPN IP
