🇺🇸
TPI-Abuse
2026-11-10 11:41:27
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:41:23.861687 2026] [security2:error] [pid 28647:tid 28647] [client 147.78.182.155:9541] ...
show more
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:41:23.861687 2026] [security2:error] [pid 28647:tid 28647] [client 147.78.182.155:9541] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||vitality-web.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "vitality-web.com"] [uri "/backstore/Ekornes/Stressless-Max-Power-Recliner-Chair.htm"] [unique_id "avMC46XR0TnVcjmxtgDCKAAAAEc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 09:40:27
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 04:40:20.809400 2026] [security2:error] [pid 15330:tid 15350] [client 147.78.182.155:17905] ...
show more
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 04:40:20.809400 2026] [security2:error] [pid 15330:tid 15350] [client 147.78.182.155:17905] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cargomarexpress.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cargomarexpress.com"] [uri "/product/mcaneworkt111354"] [unique_id "avBDhA89GyEgkkcQpTNyYwAAAQ8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 04:52:01
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 00:51:55.099391 2026] [security2:error] [pid 4677:tid 4677] [client 147.78.182.155:11409] M ...
show more
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 00:51:55.099391 2026] [security2:error] [pid 4677:tid 4677] [client 147.78.182.155:11409] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||watlab.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "watlab.com"] [uri "/"] [unique_id "auQia95j2lzmQJvXbvXPbQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 16:07:04
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 12:06:57.776492 2026] [security2:error] [pid 21109:tid 21109] [client 147.78.182.155:23921] ...
show more
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 12:06:57.776492 2026] [security2:error] [pid 21109:tid 21109] [client 147.78.182.155:23921] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.flavornet.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.flavornet.org"] [uri "/info/3268-49-3.html"] [unique_id "auIdoR-tapTIjNGsr-3PLAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 13:25:27
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 09:25:21.763263 2026] [security2:error] [pid 1278:tid 1278] [client 147.78.182.155:59245] M ...
show more
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 09:25:21.763263 2026] [security2:error] [pid 1278:tid 1278] [client 147.78.182.155:59245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||toomuchcaffeine.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "toomuchcaffeine.net"] [uri "/caffeine002.htm"] [unique_id "auH3wWylws3Wrvzs530mmQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 21:18:24
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 17:18:20.583176 2026] [security2:error] [pid 12939:tid 12939] [client 147.78.182.155:21223] ...
show more
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 17:18:20.583176 2026] [security2:error] [pid 12939:tid 12939] [client 147.78.182.155:21223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||museum.henning.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "museum.henning.org"] [uri "/dfhd007/"] [unique_id "at5yHHesCnjy6AgxT3PkjgAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 18:00:33
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 14:00:21.127131 2026] [security2:error] [pid 28262:tid 28262] [client 147.78.182.155:44427] ...
show more
(mod_security) mod_security (id:210350) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 14:00:21.127131 2026] [security2:error] [pid 28262:tid 28262] [client 147.78.182.155:44427] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||hanlontown.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "hanlontown.org"] [uri "/links/Businesses.htm"] [unique_id "at5Dte34gC6tyHrg9mUW8wAAACg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-22 16:51:17
UTC ·
(1 month ago)
[ti-01sc] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 147.78.182.155 - - [22/Sep/2026:18:50:39 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW ...
show more
[ti-01sc] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 147.78.182.155 - - [22/Sep/2026:18:50:39 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
147.78.182.155 - - [22/Sep/2026:18:50:55 +0200] "POST /wp-login.php HTTP/2.0" 200 4486 "https://www.nieuwsvoordietisten.nl/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
147.78.182.155 - - [22/Sep/2026:18:50:57 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
147.78.182.155 - - [22/Sep/2026:18:51:16 +0200] "POST /wp-login.php HT
...
show less
Brute-Force
Web App Attack
🇫🇮
bittiguru.fi
2026-09-21 15:38:39
UTC ·
(1 month ago)
147.78.182.155 - [21/Sep/2026:18:37:40 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" "4.66"
147.78.182.155 - [21/Sep/2026:18:38:39 +0300] "POST /xmlrpc.php HTTP/2.0 ...
show more
147.78.182.155 - [21/Sep/2026:18:37:40 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" "4.66"
147.78.182.155 - [21/Sep/2026:18:38:39 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "4.66"
...
show less
Hacking
Brute-Force
Web App Attack
🇩🇪
4server
2026-09-14 09:37:04
UTC ·
(1 month ago)
[MonSep1411:36:58.6485272026][security2:error][pid1622642:tid1622713][client147.78.182.155:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\ ...
show more
[MonSep1411:36:58.6485272026][security2:error][pid1622642:tid1622713][client147.78.182.155:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"www.gustotondo.ch\"][uri\"/xmlrpc.php\"][unique_id\"aqfAOguGoXPc-igubh7TdQAAAgk\"]
show less
Port Scan
Brute-Force
Web App Attack
🇩🇪
big-cloud.nl
2026-09-14 09:22:38
UTC ·
(1 month ago)
Try to access /xmlrpc.php
Web App Attack
2026-05-02 21:12:57
UTC ·
(6 months ago)
PARMACOM WEBEXPLOIT 147.78.182.155 (147.78.182.155)
Web App Attack
🇺🇸
TPI-Abuse
2026-04-28 10:47:30
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 06:47:25.466486 2026] [security2:error] [pid 2066:tid 2066] [client 147.78.182.155:42371] M ...
show more
(mod_security) mod_security (id:225170) triggered by 147.78.182.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 06:47:25.466486 2026] [security2:error] [pid 2066:tid 2066] [client 147.78.182.155:42371] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||davehalverson.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "davehalverson.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afCQPVLljPb6-CXqzLAkXQAAABI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
conseilgouz
2025-05-09 13:30:28
UTC ·
(1 year ago)
vee-13 : Block SQL injections=>/component/weblinks/?task=weblink.go&catid=15%3aannonces&id=45%3aclassic-number&Itemid=1...( AND)
Hacking
🇨🇦
wil.com
2025-03-28 08:39:10
UTC ·
(1 year ago)
GlobalProtect login attempts with user jmpatterson.
VPN IP
Brute-Force
