🇺🇸
TPI-Abuse
2026-11-14 10:01:11
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 05:01:04.373156 2026] [security2:error] [pid 5710:tid 5710] [client 122.8.93.133:11223] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 05:01:04.373156 2026] [security2:error] [pid 5710:tid 5710] [client 122.8.93.133:11223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||warnock.ws|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "warnock.ws"] [uri "/"] [unique_id "avgxYD0Ybv3lveKtmzBtUQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 12:03:31
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 07:03:27.382103 2026] [security2:error] [pid 17689:tid 17689] [client 122.8.93.133:29155] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 07:03:27.382103 2026] [security2:error] [pid 17689:tid 17689] [client 122.8.93.133:29155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.caferutadelaseda.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.caferutadelaseda.com"] [uri "/images/source/assets/owlcarousel/images/css/estilos.css"] [unique_id "avBlD1lkGOZ7ew-GyOKnFgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 22:37:53
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 17:37:49.003177 2026] [security2:error] [pid 9725:tid 9725] [client 122.8.93.133:21653] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 17:37:49.003177 2026] [security2:error] [pid 9725:tid 9725] [client 122.8.93.133:21653] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.flavornet.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.flavornet.org"] [uri "/info/6485-40-1.html"] [unique_id "aukQvQFsMmYfO7hnBR4dtwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 08:36:24
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 03:36:17.121608 2026] [security2:error] [pid 14391:tid 14391] [client 122.8.93.133:23229] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 03:36:17.121608 2026] [security2:error] [pid 14391:tid 14391] [client 122.8.93.133:23229] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||painting-with-numbers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "painting-with-numbers.com"] [uri "/blog/better-numbers"] [unique_id "auhLgZcMDSTr7omcndim2AAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 15:52:35
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210350) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 11:52:31.999729 2026] [security2:error] [pid 15838:tid 15838] [client 122.8.93.133:50931] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 11:52:31.999729 2026] [security2:error] [pid 15838:tid 15838] [client 122.8.93.133:50931] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.floorsanding.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.floorsanding.org"] [uri "/audioreferences.html"] [unique_id "atJIP_BWjmCZ4syCh3ofDgAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-03 06:04:37
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 02:04:30.899386 2026] [security2:error] [pid 2479806:tid 2479806] [client 122.8.93.133:45939] ...
show more
(mod_security) mod_security (id:210730) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 02:04:30.899386 2026] [security2:error] [pid 2479806:tid 2479806] [client 122.8.93.133:45939] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.flavornet.org|F|2"] [data ".pdb"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.flavornet.org"] [uri "/info/jmol/pdb/101-97-3.pdb"] [unique_id "asCa7qE-WsscU3cI61b-rQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-24 07:54:58
UTC ·
(1 month ago)
[ti-01sc] WordPress XML-RPC abuse: 3 suspicious requests detected by fail2ban jail apache-xmlrpc. Example: 122.8.93.133 - - [24/Sep/2026:08:56:18 +0200] "POST /xmlrpc.php HTTP/2.0" 403 87 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebK ...
show more
[ti-01sc] WordPress XML-RPC abuse: 3 suspicious requests detected by fail2ban jail apache-xmlrpc. Example: 122.8.93.133 - - [24/Sep/2026:08:56:18 +0200] "POST /xmlrpc.php HTTP/2.0" 403 87 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15"
122.8.93.133 - - [24/Sep/2026:09:15:22 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
122.8.93.133 - - [24/Sep/2026:09:54:38 +0200] "POST /xmlrpc.php HTTP/2.0" 403 88 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-12 07:53:53
UTC ·
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 12 03:53:44.954185 2026] [security2:error] [pid 27396:tid 27396] [client 122.8.93.133:44779] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 12 03:53:44.954185 2026] [security2:error] [pid 27396:tid 27396] [client 122.8.93.133:44779] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||flavornet.org|F|2"] [data ".pdb"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "flavornet.org"] [uri "/info/jmol/pdb/100-52-7.pdb"] [unique_id "anwmiF-CD7fZXc9AWQDFpQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
polycoda
2026-06-20 10:38:50
UTC ·
(4 months ago)
🔑 Wordpress login brute force attempt
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 21:47:08
UTC ·
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 17:47:01.167506 2026] [security2:error] [pid 25510:tid 25510] [client 122.8.93.133:19673] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 17:47:01.167506 2026] [security2:error] [pid 25510:tid 25510] [client 122.8.93.133:19673] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.stardancertantra.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.stardancertantra.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajMV1QrZhzXw0kjpEs4ZgQAAABY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-30 04:16:54
UTC ·
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 23:16:47.567211 2025] [security2:error] [pid 25383:tid 25383] [client 122.8.93.133:14215] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 122.8.93.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 23:16:47.567211 2025] [security2:error] [pid 25383:tid 25383] [client 122.8.93.133:14215] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||disio.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "disio.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aVNSL0mSY9EZUNDyKKgHdgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
maxxsense
2025-12-27 21:14:16
UTC ·
(10 months ago)
(wordpress) Failed wordpress login from 122.8.93.133 (CN/China/-)
Brute-Force
