🇩🇪
netclix.gr
2026-10-05 13:59:55
(3 weeks ago)
(fake_mac) Blocked fake Macintosh Chrome 116.212.185.149 (BD/Bangladesh/-): (CF_ENABLE)
Hacking
2026-10-05 11:25:02
(3 weeks ago)
Bot / scanning and/or hacking attempts: GET /xmlrpc.php HTTP/1.1, POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇨🇦
internetworld
2026-10-05 06:11:05
(3 weeks ago)
116.212.185.149 - - [05/Oct/2026:06:11:03 +0000] "POST /xmlrpc.php HTTP/1.1" 405 166 "-" "Mozilla/5. ...
show more
116.212.185.149 - - [05/Oct/2026:06:11:03 +0000] "POST /xmlrpc.php HTTP/1.1" 405 166 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/13.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇫🇮
abdubhai
2026-10-05 03:38:01
(3 weeks ago)
116.212.185.149 - - [05/Oct/2026
...
Brute-Force
🇺🇸
TPI-Abuse
2026-10-04 12:37:34
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 116.212.185.149 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 116.212.185.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 08:37:27.743632 2026] [security2:error] [pid 29418:tid 29418] [client 116.212.185.149:48028] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||carlosmol.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "carlosmol.com"] [uri "/"] [unique_id "asJIh3HIfsfzn_k0qSUgrAAAABI"], referer: https://automaticbacklinkbuilder.site/dir/backlinks-for-websites-34343
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
abdubhai
2026-10-04 12:27:43
(3 weeks ago)
116.212.185.149 - - [04/Oct/2026
...
Brute-Force
🇳🇱
Site.eu
2026-10-04 08:54:27
(3 weeks ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-10-04 05:11:10
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 116.212.185.149 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 116.212.185.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 01:11:03.745714 2026] [security2:error] [pid 16394:tid 16394] [client 116.212.185.149:41538] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||emilyormen.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "emilyormen.com"] [uri "/"] [unique_id "asHf58kJgXSiLgBUcgTIHQAAAAc"], referer: https://freedofollow.website/dir/organic-visibility-backlinks-64577
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
giulio gorobey
2026-10-04 03:48:38
(3 weeks ago)
[Drupal AbuseIPDB module] Request path is blacklisted. /xmlrpc.php
Web App Attack
🇳🇱
DrLex0
2026-10-03 09:20:53
(3 weeks ago)
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt an ...
show more
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives
116.212.185.149 443 - [03/Oct/2026:09:20:53 +0000] "GET [redacted] HTTP/1.1" 410 6095 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:147.0) Gecko/20100101 Firefox/147.0"
show less
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-10-03 08:20:41
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 116.212.185.149 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 116.212.185.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 04:20:34.415720 2026] [security2:error] [pid 15621:tid 15621] [client 116.212.185.149:47822] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rlysue.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rlysue.com"] [uri "/"] [unique_id "asC60sPCXsluOQ89eNcuIAAAAAo"], referer: https://onlinebacklinkbuilder.site/dir/strong-domain-backlinks-177470
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 12:54:39
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 116.212.185.149 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 116.212.185.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 08:54:34.225306 2026] [security2:error] [pid 17832:tid 17832] [client 116.212.185.149:56328] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||noxiousthoughts.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "noxiousthoughts.com"] [uri "/"] [unique_id "ar-pihsGipcgkcW6aFI0gQAAABY"], referer: https://seopbn.shop/dir/organic-visibility-backlinks-150677
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 07:07:18
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 116.212.185.149 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 116.212.185.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 03:07:11.320363 2026] [security2:error] [pid 2669:tid 2716] [client 116.212.185.149:54930] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||gelatoconsapevole.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "gelatoconsapevole.com"] [uri "/"] [unique_id "ar4Gn8Fv-BUhxM-lenP6AQAAARI"], referer: https://naturallinkbuilding.store/dir/manual-link-building-services-79990
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-09-30 04:49:37
(3 weeks ago)
Bad bot ignoring robot.txt
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-30 04:10:31
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 116.212.185.149 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 116.212.185.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 00:10:26.684886 2026] [security2:error] [pid 24452:tid 24452] [client 116.212.185.149:46222] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lisaslearningland.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lisaslearningland.com"] [uri "/"] [unique_id "aryLshDlW5Lf4ju_umJs_gAAABY"], referer: https://massbacklinkgenerator.website/dir/editorial-link-building-122960
show less
Brute-Force
Bad Web Bot
Web App Attack