|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210350) triggered by 155.212.110.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:49:06.684972 2026] [security2:error] [pid 24859:tid 24859] [client 155.212.110.18:44677] ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.110.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:49:06.684972 2026] [security2:error] [pid 24859:tid 24859] [client 155.212.110.18:44677] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||frankpollicino.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "frankpollicino.com"] [uri "/random-blogs.html"] [unique_id "atklQmKOvWuXNYfLxuTzbAAAAA4"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210350) triggered by 155.212.110.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:13:21.388480 2026] [security2:error] [pid 5520:tid 5520] [client 155.212.110.18:64145] M ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.110.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:13:21.388480 2026] [security2:error] [pid 5520:tid 5520] [client 155.212.110.18:64145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||johnmueller.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "johnmueller.org"] [uri "/Problems/Stutter.html"] [unique_id "atkc4RL6nZAlWuVwngfvrwAAAAs"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210350) triggered by 155.212.110.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 20:54:54.784317 2026] [security2:error] [pid 18213:tid 18213] [client 155.212.110.18:54623] ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.110.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 20:54:54.784317 2026] [security2:error] [pid 18213:tid 18213] [client 155.212.110.18:54623] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||joshuashands.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "joshuashands.org"] [uri "/2014_Zachary.html"] [unique_id "atgNXolQt5tCZ-858iQeGQAAABE"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇳🇱
DonAtari
|
|
DShield firewall scan - TCP to port 8080
|
Brute-Force
SSH
|
|
🇺🇸
OceanTreasure
|
|
tcp/443; GitLab REST API project enumeration attempt (/api/v4/projects/) looking for an unauthenticated repository listing: "GET /api/v4/projects/" @ 2026-09-17T16:51:43Z [proxy]
|
Web App Attack
|
|
🇨🇿
Countryman
|
|
repeated unauthorized VPN login attempt, user sweep
|
VPN IP
Hacking
Brute-Force
|
|
🇨🇿
lp
|
|
Unauthorized VPN login attempts: 1 attempts were recorded from 155.212.110.18
2026-09-09T20:09:14+02:00 vpn Access-Reject 'jetjarin' station: 155.212.110.18 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<reda ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 155.212.110.18
2026-09-09T20:09:14+02:00 vpn Access-Reject 'jetjarin' station: 155.212.110.18 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
|
Brute-Force
Web App Attack
|
|
🇺🇸
floreriaexpress
|
|
FakeADS-Anti: country:TR | https://floreriaexpresschile.cl/product-category/recomendaciones/quieres-ser-mi-novia/?add-to-cart=102235
|
Bad Web Bot
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 155.212.110.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 08:05:09.573987 2026] [security2:error] [pid 26572:tid 26572] [client 155.212.110.18:38083] ...
show more
(mod_security) mod_security (id:225170) triggered by 155.212.110.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 08:05:09.573987 2026] [security2:error] [pid 26572:tid 26572] [client 155.212.110.18:38083] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||grupogasa.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "grupogasa.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai1Hdbo9ygd703IEM0M0HQAAAAg"], referer: https://www.google.com
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 155.212.110.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 05:16:33.493877 2026] [security2:error] [pid 31430:tid 31430] [client 155.212.110.18:32135] ...
show more
(mod_security) mod_security (id:225170) triggered by 155.212.110.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 05:16:33.493877 2026] [security2:error] [pid 31430:tid 31430] [client 155.212.110.18:32135] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||scorpio01.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "scorpio01.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai0f8cX9Q0yg1bEMfAeY7AAAABY"], referer: https://www.google.com
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 155.212.110.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 12:39:18.764907 2026] [security2:error] [pid 3716:tid 3716] [client 155.212.110.18:47049] M ...
show more
(mod_security) mod_security (id:225170) triggered by 155.212.110.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 12:39:18.764907 2026] [security2:error] [pid 3716:tid 3716] [client 155.212.110.18:47049] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||emmtrucking.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "emmtrucking.com"] [uri "/wp-json/wp/v2/users"] [unique_id "airktqBdKIN1o2PaxUpYXAAAAA8"], referer: https://www.google.com
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
Anonymous
|
|
FPROCO WEBEXPLOIT 155.212.110.18 (155.212.110.18)
|
Web App Attack
|
|
🇺🇸
kosada.com
|
|
Web password guessing
|
Brute-Force
|
|
🇺🇸
kosada.com
|
|
Web password guessing
|
Brute-Force
|
|
🇺🇸
ambor
|
|
Honeypot triggered on tcpdata.com - Attempted to access /wp-login.php (wordpress_login). User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
|
Web App Attack
|
