🇺🇸
TPI-Abuse
2026-11-09 15:52:20
UTC ·
(18 hours ago)
(mod_security) mod_security (id:210350) triggered by 94.76.159.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 10:52:18.162555 2026] [security2:error] [pid 17685:tid 17685] [client 94.76.159.15:43913] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 94.76.159.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 10:52:18.162555 2026] [security2:error] [pid 17685:tid 17685] [client 94.76.159.15:43913] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||vitality-web.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "vitality-web.com"] [uri "/Stressless-Chair/Stressless-Cori-Black-Leather.htm"] [unique_id "avHsMsRSsSkQKKVYIexTAAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 11:35:09
UTC ·
(22 hours ago)
(mod_security) mod_security (id:210350) triggered by 94.76.159.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 06:35:02.519129 2026] [security2:error] [pid 20119:tid 20119] [client 94.76.159.15:54029] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 94.76.159.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 06:35:02.519129 2026] [security2:error] [pid 20119:tid 20119] [client 94.76.159.15:54029] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.coffeewitheinstein.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.coffeewitheinstein.com"] [uri "/domains/needtoorder150/cgi-bin/"] [unique_id "avGv5jNsYJoh7gBgtI_qMgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 01:33:28
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 94.76.159.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 20:33:23.906441 2026] [security2:error] [pid 22405:tid 22405] [client 94.76.159.15:19181] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 94.76.159.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 20:33:23.906441 2026] [security2:error] [pid 22405:tid 22405] [client 94.76.159.15:19181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2015/07/22/us-successfully-kills-fictional-terror-groups-leader-a-3rd-time/"] [unique_id "auvc4wk6dvyXyMcx-6HXlwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 13:31:53
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 94.76.159.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 09:31:50.507929 2026] [security2:error] [pid 22168:tid 22168] [client 94.76.159.15:61523] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 94.76.159.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 09:31:50.507929 2026] [security2:error] [pid 22168:tid 22168] [client 94.76.159.15:61523] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||damova.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "damova.net"] [uri "/pages/artist-books/evisreal.html"] [unique_id "auCnxrNOye9Sy-0W2oShngAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 03:41:16
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 94.76.159.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 23:41:10.544137 2026] [security2:error] [pid 19100:tid 19100] [client 94.76.159.15:41179] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 94.76.159.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 23:41:10.544137 2026] [security2:error] [pid 19100:tid 19100] [client 94.76.159.15:41179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||franklincountyquilters.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "franklincountyquilters.org"] [uri "/fcqgshowntell1122/target0.html"] [unique_id "at16VgDGj64KTJnrJBcKHwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
EntrustIT
2026-09-13 18:27:19
UTC ·
(1 month ago)
SSL VPN brute-force: 1 failed login attempts between 2026-09-13 18:27 and 2026-09-13 18:27 UTC. Usernames tried included: christopher.
Brute-Force
SSH
🇬🇧
EntrustIT
2026-09-10 18:47:50
UTC ·
(1 month ago)
Fortigate SSL-VPN brute force / credential stuffing. 1 failed login attempt(s) between 2026-09-10 18:47:50 and 2026-09-10 18:47:50 UTC. Usernames attempted (sample): chris.
Brute-Force
🇺🇸
lostswordfish.com
2026-05-19 16:02:04
UTC ·
(5 months ago)
Wordfence waf block on ncrsol
Web App Attack
