🇺🇸
TPI-Abuse
2026-11-13 13:12:01
UTC ·
(14 hours ago)
(mod_security) mod_security (id:210350) triggered by 162.252.55.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 08:11:55.587144 2026] [security2:error] [pid 24161:tid 24161] [client 162.252.55.150:58719] ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.55.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 08:11:55.587144 2026] [security2:error] [pid 24161:tid 24161] [client 162.252.55.150:58719] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||deindo.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "deindo.com"] [uri "/links.html"] [unique_id "avcMm5KWyAsrqazRuThEWgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇭🇰
sandra361
2026-11-11 11:05:18
UTC ·
(2 days ago)
Port scan detected: 8 packets across 1 port (8480). | Evidence: REAPER_TARPIT: IN=eth0 SRC=162.252.55.150 LEN=40 TOS=0x14 PREC=0x00 TTL=109 ID=60668 DF PROTO=TCP SPT=39431 DPT=8480 WINDOW=42340 RES=0x00 ACK FIN URGP=0
Port Scan
🇺🇸
TPI-Abuse
2026-11-10 14:49:27
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 162.252.55.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:49:21.992829 2026] [security2:error] [pid 8103:tid 8103] [client 162.252.55.150:64671] M ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.55.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:49:21.992829 2026] [security2:error] [pid 8103:tid 8103] [client 162.252.55.150:64671] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.jerusalem-korczak-home.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.jerusalem-korczak-home.com"] [uri "/arhiv03.htm"] [unique_id "avMu8eGSypy_QNzWFhhCTAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 03:22:24
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 162.252.55.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:22:20.411116 2026] [security2:error] [pid 3954:tid 3954] [client 162.252.55.150:36653] M ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.55.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:22:20.411116 2026] [security2:error] [pid 3954:tid 3954] [client 162.252.55.150:36653] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||passwordresearch.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "passwordresearch.com"] [uri "/papers/paper468.html"] [unique_id "au1H7FRmSKTpejOZZybU6AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 06:07:17
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 162.252.55.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 01:07:12.421829 2026] [security2:error] [pid 16790:tid 16790] [client 162.252.55.150:40221] ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.55.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 01:07:12.421829 2026] [security2:error] [pid 16790:tid 16790] [client 162.252.55.150:40221] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "aul6EKhufBxg4zA4KPfsUwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-10-30 13:12:01
UTC ·
(2 weeks ago)
block ruleset 798ECF92F12ADC636D3520C2890AF17ADEFDE3BE
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-21 19:08:31
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 162.252.55.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 15:08:24.078812 2026] [security2:error] [pid 27658:tid 27658] [client 162.252.55.150:24733] ...
show more
(mod_security) mod_security (id:210350) triggered by 162.252.55.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 15:08:24.078812 2026] [security2:error] [pid 27658:tid 27658] [client 162.252.55.150:24733] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jimvassilakos.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jimvassilakos.com"] [uri "/dos-programs/tssi.html"] [unique_id "atkNqB69sH6H8Jfh9vfLwgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-10-03 21:03:57
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-10-03 15:21:37
UTC ·
(1 month ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 162.252.55.150
2026-10-03T16:49:53+02:00 vpn Access-Reject 'backup' station: 162.252.55.150 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redact ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 162.252.55.150
2026-10-03T16:49:53+02:00 vpn Access-Reject 'backup' station: 162.252.55.150 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇺🇸
NetGuard
2026-10-01 03:21:35
UTC ·
(1 month ago)
#honeypot #netguard247 #ciscoasa
Captured by NetGuard 24/7 T-Pot honeypot (netguard24-7.com).
Timestamp: 2026-10-01T03:17:40.945+00:00
Attacker IP: 162.252.55.150 | Port: N/A | Country: United States
Honeypot: ciscoasa | Attack: unknown
Activity: 3 h ...
show more
#honeypot #netguard247 #ciscoasa
Captured by NetGuard 24/7 T-Pot honeypot (netguard24-7.com).
Timestamp: 2026-10-01T03:17:40.945+00:00
Attacker IP: 162.252.55.150 | Port: N/A | Country: United States
Honeypot: ciscoasa | Attack: unknown
Activity: 3 hits between 2026-10-01T03:17:40.945+00:00 and 2026-10-01T03:17:41.812+00:00 (6h window 2026-10-01T00:00:00.000Z)
Source: NetGuard 24/7 (netguard24-7.com) | PhantomGrid Defense
show less
Web App Attack
🇨🇿
Countryman
2026-10-01 00:10:02
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇩🇪
LRob
2026-09-15 13:22:36
UTC ·
(1 month ago)
Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for | method: GET | path: / | 2026-09-15 13:22 UTC
Bad Web Bot
🇩🇪
C C
2026-08-09 00:54:39
UTC ·
(3 months ago)
Distributed scraping attack: 1469 req from 1403 rotating proxy IPs, waves of up to 150 req in 291s on a single URL | this IP: 1 req, 1 blocked
Open Proxy
Bad Web Bot
Web App Attack
2026-05-05 18:00:21
UTC ·
(6 months ago)
Forum/form spam
Web Spam
