🇺🇸
TPI-Abuse
2026-11-11 12:09:14
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 07:09:00.153876 2026] [security2:error] [pid 16302:tid 16302] [client 104.245.243.222:5245 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 07:09:00.153876 2026] [security2:error] [pid 16302:tid 16302] [client 104.245.243.222:52455] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||dwightbrown.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "dwightbrown.com"] [uri "/great-clip-on-lies-and-deception/"] [unique_id "avRa3JXbrwgvOblndbuqdgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 12:54:02
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 07:53:46.394278 2026] [security2:error] [pid 25982:tid 25982] [client 104.245.243.222:2944 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 07:53:46.394278 2026] [security2:error] [pid 25982:tid 25982] [client 104.245.243.222:29447] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.themadwriter.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.themadwriter.us"] [uri "/original-intent-9197.htm"] [unique_id "avHCWhTgYoVxPuqhtU-jtQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 08:51:08
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 03:50:53.008744 2026] [security2:error] [pid 7063:tid 7063] [client 104.245.243.222:52717] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 03:50:53.008744 2026] [security2:error] [pid 7063:tid 7063] [client 104.245.243.222:52717] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.guardmagic.eu|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.guardmagic.eu"] [uri "/3-application/11-00-minitoring-by-application.htm"] [unique_id "avGJbbXAu4UAS2Ht9gXOSAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 05:21:21
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 00:21:06.521036 2026] [security2:error] [pid 6909:tid 6909] [client 104.245.243.222:47833] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 00:21:06.521036 2026] [security2:error] [pid 6909:tid 6909] [client 104.245.243.222:47833] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2015/12/16/2016-plans/"] [unique_id "augdwiVSuuAR4_XwZdhDWQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 17:25:15
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 13:24:58.960689 2026] [security2:error] [pid 15814:tid 15814] [client 104.245.243.222:1224 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 13:24:58.960689 2026] [security2:error] [pid 15814:tid 15814] [client 104.245.243.222:12241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||neff.family.name|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "neff.family.name"] [uri "/unwiki/doku.php"] [unique_id "auOBakrhET_OhF_uzlfmDQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 18:08:17
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:08:00.446509 2026] [security2:error] [pid 5677:tid 5677] [client 104.245.243.222:59443] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:08:00.446509 2026] [security2:error] [pid 5677:tid 5677] [client 104.245.243.222:59443] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||iee-usa.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "iee-usa.com"] [uri "/evaluationservices.htm"] [unique_id "auI6ADgnTXJB4BPwyLix4wAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-17 22:33:01
UTC ·
(3 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇺🇸
mw
2026-07-02 07:54:09
UTC ·
(4 months ago)
VPN bruteforce
Brute-Force
🇧🇬
HighWay
2026-07-02 01:17:41
UTC ·
(4 months ago)
104.245.243.222 - - [02/Jul/2026:01:17:38 +0000] "GET /wp-json/wp/v2/users HTTP/1.1" 200 6057 "-" "Go-http-client/1.1"
104.245.243.222 - - [02/Jul/2026:01:17:38 +0000] "GET /wp-login.php HTTP/1.1" 200 6984 "-" "Go-http-client/1.1"
104.245.243.222 - - ...
show more
104.245.243.222 - - [02/Jul/2026:01:17:38 +0000] "GET /wp-json/wp/v2/users HTTP/1.1" 200 6057 "-" "Go-http-client/1.1"
104.245.243.222 - - [02/Jul/2026:01:17:38 +0000] "GET /wp-login.php HTTP/1.1" 200 6984 "-" "Go-http-client/1.1"
104.245.243.222 - - [02/Jul/2026:01:17:40 +0000] "POST /wp-login.php HTTP/1.1" 200 7066 "https://jobseu.org/wp-login.php" "Go-http-client/1.1"
...
show less
Port Scan
Bad Web Bot
Web App Attack
2026-06-28 05:52:52
UTC ·
(4 months ago)
This IP was involved in an brute force and password spray attack on 2026/06/28 00:49:07
Port Scan
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 11:30:54
UTC ·
(4 months ago)
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 07:30:46.633240 2026] [security2:error] [pid 7385:tid 7385] [client 104.245.243.222:16837] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.245.243.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 07:30:46.633240 2026] [security2:error] [pid 7385:tid 7385] [client 104.245.243.222:16837] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||garon.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "garon.us"] [uri "/adminer/index.php"] [unique_id "aju_5g3HebG26gXaSkz6YwAAACo"], referer: https://garon.us/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Ba-Yu
2026-06-24 06:40:56
UTC ·
(4 months ago)
General hacking/exploits/scanning
Web Spam
Hacking
Brute-Force
Exploited Host
Web App Attack
🇦🇺
MAGIC
2026-06-20 01:08:26
UTC ·
(4 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇺🇸
mnsf
2026-06-19 18:07:11
UTC ·
(4 months ago)
Abuse Detected (1)
Brute-Force
Web App Attack
🇺🇸
Victor López
2026-06-15 07:44:02
UTC ·
(5 months ago)
livingbalance.earth 104.245.243.222 - - [15/Jun/2026:02:44:00 -0500] "POST /xmlrpc.php HTTP/1.1" 405 150 "-" "Wget/1.21.4"
livingbalance.earth 104.245.243.222 - - [15/Jun/2026:02:44:00 -0500] "POST /xmlrpc.php HTTP/1.1" 405 150 "-" "curl/7.88.1"
livi ...
show more
livingbalance.earth 104.245.243.222 - - [15/Jun/2026:02:44:00 -0500] "POST /xmlrpc.php HTTP/1.1" 405 150 "-" "Wget/1.21.4"
livingbalance.earth 104.245.243.222 - - [15/Jun/2026:02:44:00 -0500] "POST /xmlrpc.php HTTP/1.1" 405 150 "-" "curl/7.88.1"
livingbalance.earth 104.245.243.222 - - [15/Jun/2026:02:44:01 -0500] "POST /xmlrpc.php HTTP/1.1" 405 150 "-" "curl/7.88.1"
...
show less
Hacking
Web App Attack
