🇺🇸
TPI-Abuse
2026-11-15 09:26:47
UTC ·
(5 minutes ago)
(mod_security) mod_security (id:210350) triggered by 147.78.180.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 04:26:41.034339 2026] [security2:error] [pid 9013:tid 9013] [client 147.78.180.11:64711] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 147.78.180.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 04:26:41.034339 2026] [security2:error] [pid 9013:tid 9013] [client 147.78.180.11:64711] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ofertasdetrabajosyempleos.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ofertasdetrabajosyempleos.com"] [uri "/mexico/buscador-educadora-zacatecas.php"] [unique_id "avl60Xz93OKQqf-L6MCdvgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 02:09:12
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 147.78.180.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 21:09:05.351988 2026] [security2:error] [pid 25521:tid 25521] [client 147.78.180.11:25579] M ...
show more
(mod_security) mod_security (id:210350) triggered by 147.78.180.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 21:09:05.351988 2026] [security2:error] [pid 25521:tid 25521] [client 147.78.180.11:25579] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bostonlog.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bostonlog.com"] [uri "/2013-there-has-been-a-bomb-and-i-am-all-alone-and-scared-to-death/"] [unique_id "avfCwayBZXB1XYoktlLQsAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 18:51:35
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 147.78.180.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 13:51:31.582842 2026] [security2:error] [pid 10622:tid 10622] [client 147.78.180.11:46755] M ...
show more
(mod_security) mod_security (id:210350) triggered by 147.78.180.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 13:51:31.582842 2026] [security2:error] [pid 10622:tid 10622] [client 147.78.180.11:46755] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||virginians.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "virginians.com"] [uri "/topics/248.htm"] [unique_id "auzQM2Dn5Lxw3CJxlKpiJQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 06:43:43
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 147.78.180.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:43:38.081495 2026] [security2:error] [pid 22203:tid 22203] [client 147.78.180.11:46891] M ...
show more
(mod_security) mod_security (id:210350) triggered by 147.78.180.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:43:38.081495 2026] [security2:error] [pid 22203:tid 22203] [client 147.78.180.11:46891] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.flavornet.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.flavornet.org"] [uri "/info/2463-77-6.html"] [unique_id "auwlmlrfelnKl2esfdWA7wAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
CoreTech srl
2026-10-30 21:54:00
UTC ·
(2 weeks ago)
cloudlinux2 fail2ban: 2026-10-30 22:48:53,672 fail2ban.filter [1802]: INFO [plesk-wordpress] Found 77.220.193.249 - 2026-10-30 22:48:53cloudlinux2 fail2ban: 2026-10-30 22:48:49,758 fail2ban.filter [1802]: INFO [plesk-wordpress] ...
show more
cloudlinux2 fail2ban: 2026-10-30 22:48:53,672 fail2ban.filter [1802]: INFO [plesk-wordpress] Found 77.220.193.249 - 2026-10-30 22:48:53cloudlinux2 fail2ban: 2026-10-30 22:48:49,758 fail2ban.filter [1802]: INFO [plesk-wordpress] Found 193.202.13.33 - 2026-10-30 22:48:49cloudlinux2 fail2ban: 2026-10-30 22:49:03,602 fail2ban.filter [1802]: INFO [plesk-wordpress] Found 194.104.8.252 - 2026-10-30 22:49:03cloudlinux2 fail2ban: 2026-10-30 22:48:59,020 fail2ban.filter [1802]: INFO [plesk-wordpress] Found 166.88.178.212 - 2026-10-30 22:48:58cloudlinux2 fail2ban: 2026-10-30 22:49:34,425 fail2ban.filter [1802]: INFO [plesk-wordpress] Found 185.61.217.221 - 2026-10-30 22:49:34cloudlinux2 fail2ban: 2026-10-30 22:49:44,017 fail2ban.filter [1802]: INFO [plesk-wordpress] Found 193.202.86.183 - 2026-10-30 22:49:43cloudlinux2 fail2ban: 2026-10-30 22:50:14,795 fail2ban.filter [1802]: INFO [plesk-wordpress] Found 45.135.2.24 - 2026-10-30 22:50:13cloudli
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 18:27:31
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 147.78.180.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:27:24.041502 2026] [security2:error] [pid 21193:tid 21193] [client 147.78.180.11:9395] Mo ...
show more
(mod_security) mod_security (id:210350) triggered by 147.78.180.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:27:24.041502 2026] [security2:error] [pid 21193:tid 21193] [client 147.78.180.11:9395] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||killarneypool.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "killarneypool.org"] [uri "/board-members.html"] [unique_id "auI-jCLPl0FJ8-Gz3XANoAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
ddw
2026-10-28 15:48:54
UTC ·
(2 weeks ago)
Access Violation Attempts - Multiple 403 Forbidden responses.
Hacking
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-10-26 18:42:02
UTC ·
(2 weeks ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 02:19:19
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 147.78.180.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 22:19:14.698784 2026] [security2:error] [pid 15277:tid 15277] [client 147.78.180.11:23805] M ...
show more
(mod_security) mod_security (id:210350) triggered by 147.78.180.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 22:19:14.698784 2026] [security2:error] [pid 15277:tid 15277] [client 147.78.180.11:23805] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||grandersonheatingandcooling.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "grandersonheatingandcooling.com"] [uri "/"] [unique_id "at64ov-EiInrdzMyrZHZFwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
OnTheEdge
2026-09-14 09:10:41
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇸🇪
OnTheEdge
2026-09-14 09:10:41
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇿
lp
2026-09-11 06:21:16
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 147.78.180.11
2026-09-11T06:57:23+02:00 vpn Access-Reject 'daduis_orozco' station: 147.78.180.11 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<r ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 147.78.180.11
2026-09-11T06:57:23+02:00 vpn Access-Reject 'daduis_orozco' station: 147.78.180.11 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇭
SOC [GOLINE SA]
2026-09-08 23:03:18
UTC ·
(2 months ago)
[RoutePulse | 2026-09-08T23:03:18Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 147.78.180.11
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed attack (3 attempts/15min) — shun on the VPN g ...
show more
[RoutePulse | 2026-09-08T23:03:18Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 147.78.180.11
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed attack (3 attempts/15min) — shun on the VPN gateway
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
Brute-Force
Hacking
2026-05-04 11:48:21
UTC ·
(6 months ago)
Forum/form spam
Web Spam
🇺🇸
MPL
2025-12-04 15:05:35
UTC ·
(11 months ago)
tcp/443 (8 or more attempts)
Port Scan
