🇺🇸
TPI-Abuse
2026-11-11 10:09:02
UTC ·
(16 hours ago)
(mod_security) mod_security (id:210350) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 05:08:53.782508 2026] [security2:error] [pid 9467:tid 9491] [client 155.212.110.38:30863] M ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 05:08:53.782508 2026] [security2:error] [pid 9467:tid 9491] [client 155.212.110.38:30863] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.julianositalianrestaurant.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.julianositalianrestaurant.com"] [uri "/Penne-Arriabiata-Con-Pollo.html"] [unique_id "avQ-td_O7LF_8H4Q1UjrLQAAANQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 11:42:07
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 06:41:59.757156 2026] [security2:error] [pid 3463:tid 3463] [client 155.212.110.38:57895] M ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 06:41:59.757156 2026] [security2:error] [pid 3463:tid 3463] [client 155.212.110.38:57895] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.djbadger.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.djbadger.com"] [uri "/art/2011/duality/duality.htm"] [unique_id "avGxh3sCj-WiSkRAZ9JKygAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 17:12:08
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 12:12:04.626280 2026] [security2:error] [pid 22867:tid 22867] [client 155.212.110.38:30811] ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 12:12:04.626280 2026] [security2:error] [pid 22867:tid 22867] [client 155.212.110.38:30811] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||cometoorderva.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cometoorderva.com"] [uri "/wakey-wakey-wake-up-shaky/"] [unique_id "avCtZH7T-gxdmOrJn0lh-wAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 14:16:55
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 10:16:51.692643 2026] [security2:error] [pid 4340:tid 4340] [client 155.212.110.38:30455] M ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 10:16:51.692643 2026] [security2:error] [pid 4340:tid 4340] [client 155.212.110.38:30455] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.microdot.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.microdot.net"] [uri "/nlp/eye-patterns/eye-pattern-diagram.shtml"] [unique_id "auNVUz89SyNCLUw35UaX9QAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-10-29 00:18:46
UTC ·
(2 weeks ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 06:00:00
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 01:59:56.362300 2026] [security2:error] [pid 28862:tid 28862] [client 155.212.110.38:12809] ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 01:59:56.362300 2026] [security2:error] [pid 28862:tid 28862] [client 155.212.110.38:12809] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.athletefirst.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.athletefirst.org"] [uri "/"] [unique_id "at2a3P_LYZkxekp6wVjexAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Ilop
2026-10-13 01:00:08
UTC ·
(4 weeks ago)
[hp-100] 19 unsolicited packets to honeypot ports 5555 (OCI DShield sensor)
Port Scan
🇩🇪
4server
2026-08-19 15:10:43
UTC ·
(2 months ago)
[WedAug1917:10:41.1309332026][security2:error][pid2612597:tid2612641][client155.212.110.38:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\ ...
show more
[WedAug1917:10:41.1309332026][security2:error][pid2612597:tid2612641][client155.212.110.38:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"www.gustotondo.ch\"][uri\"/xmlrpc.php\"][unique_id\"aoXHcT7cqWSzYoTY3t3xowAAAMg\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
ph
2026-07-06 16:52:11
UTC ·
(4 months ago)
Bad web bot attempting to run wp-login.php on non-WP site
Hacking
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-06-12 22:07:29
UTC ·
(4 months ago)
[SatJun1300:07:25.5334472026][security2:error][pid2171836:tid2173284][client155.212.110.38:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"367\"][id\ ...
show more
[SatJun1300:07:25.5334472026][security2:error][pid2171836:tid2173284][client155.212.110.38:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"367\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"www.motogiro.com\"][uri\"/xmlrpc.php\"][unique_id\"aiyDHdsQ9Qq3p22hpDot0gAAAIo\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-10-15 21:50:38
UTC ·
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 15 17:50:31.275196 2025] [security2:error] [pid 9090:tid 9090] [client 155.212.110.38:56863] M ...
show more
(mod_security) mod_security (id:225170) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 15 17:50:31.275196 2025] [security2:error] [pid 9090:tid 9090] [client 155.212.110.38:56863] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||humbliaslaw.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "humbliaslaw.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aPAXJ5mSoh1LjtCk6KKpsQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-15 15:59:02
UTC ·
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 15 11:58:57.631691 2025] [security2:error] [pid 11155:tid 11155] [client 155.212.110.38:26863] ...
show more
(mod_security) mod_security (id:225170) triggered by 155.212.110.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 15 11:58:57.631691 2025] [security2:error] [pid 11155:tid 11155] [client 155.212.110.38:26863] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hawarcenter.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hawarcenter.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aO_EwZ1F5nK5MnqStVv8CwAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
Burayot
2025-10-15 15:29:59
UTC ·
(1 year ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 155.212.110.38 (TR/Türkiye/-): 1 in the last 3600 secs
Web App Attack
🇨🇭
backslash
2025-10-14 09:50:27
UTC ·
(1 year ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
