🇩🇪
FeG Deutschland
2026-11-09 21:52:35
UTC ·
(59 minutes ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 18:36:39
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 13:36:33.597844 2026] [security2:error] [pid 619:tid 619] [client 155.212.111.101:48199] M ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 13:36:33.597844 2026] [security2:error] [pid 619:tid 619] [client 155.212.111.101:48199] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||celebritybikinigossip.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "celebritybikinigossip.com"] [uri "/2013/11/tamara-ecclestone-bikini-pictures-6/"] [unique_id "au4eMQsK0Pa73F8vPA9vvQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
abivia
2026-10-30 22:21:27
UTC ·
(1 week ago)
Abivia WAF trigger: Rule scriptKiddies: Probing for vulnerabilities uri: /oembed.php?url=https%3A%2F%2Fambitonline.com%2Fnextrelease%2F2008%2F08%2Fin-search-of-an-application-framework-php-gtk-python-xulrunner%2F&format=xml
Hacking
🇺🇸
TPI-Abuse
2026-10-28 20:22:53
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 16:22:46.225866 2026] [security2:error] [pid 24391:tid 24426] [client 155.212.111.101:5631 ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 16:22:46.225866 2026] [security2:error] [pid 24391:tid 24426] [client 155.212.111.101:56315] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||certifiedfinancialanalyst.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "certifiedfinancialanalyst.org"] [uri "/Book-Certified-Financial-Analyst-Free-48.html"] [unique_id "auJZlrR77RZX8XQAisWDDQAAAJc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 18:25:08
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:24:56.160967 2026] [security2:error] [pid 32284:tid 32297] [client 155.212.111.101:4977 ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:24:56.160967 2026] [security2:error] [pid 32284:tid 32297] [client 155.212.111.101:49773] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||econpage.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "econpage.com"] [uri "/202/handouts/equations.html"] [unique_id "auI9-A8TJzmdQRftd6XDVQAAAIw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 16:38:20
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 12:38:13.852252 2026] [security2:error] [pid 21466:tid 21466] [client 155.212.111.101:3381 ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 12:38:13.852252 2026] [security2:error] [pid 21466:tid 21466] [client 155.212.111.101:33815] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aes-nihil.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aes-nihil.com"] [uri "/index2.html"] [unique_id "at-B9akeRSKzamwCJfcZhQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 16:47:33
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 12:47:27.489916 2026] [security2:error] [pid 18257:tid 18257] [client 155.212.111.101:6499 ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 12:47:27.489916 2026] [security2:error] [pid 18257:tid 18257] [client 155.212.111.101:64995] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.mountararattrek.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.mountararattrek.com"] [uri "/van_earthquake_2012.htm"] [unique_id "at4yn2jRvN0RGR_5CcNsOwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 19:55:25
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 15:55:18.148399 2026] [security2:error] [pid 5380:tid 5380] [client 155.212.111.101:9039] ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 15:55:18.148399 2026] [security2:error] [pid 5380:tid 5380] [client 155.212.111.101:9039] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.anamericanabroad.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.anamericanabroad.com"] [uri "/the-most-common-mistakes-tourists-make-in-the-uk/"] [unique_id "atkYph3cna-GliGyWHDFdQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-14 16:48:38
UTC ·
(2 months ago)
IM360 WAF: Detects MySQL and PostgreSQL stored procedure/function injections
SQL Injection
🇺🇸
TPI-Abuse
2026-05-20 22:02:31
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 18:02:27.422520 2026] [security2:error] [pid 24314:tid 24314] [client 155.212.111.101:6530 ...
show more
(mod_security) mod_security (id:225170) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 18:02:27.422520 2026] [security2:error] [pid 24314:tid 24314] [client 155.212.111.101:65303] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mithryl.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mithryl.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag4vc6X9FvXfkjYXe8CRNAAAABw"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-12 23:57:48
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 19:57:44.686273 2026] [security2:error] [pid 8849:tid 8849] [client 155.212.111.101:29341] ...
show more
(mod_security) mod_security (id:225170) triggered by 155.212.111.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 19:57:44.686273 2026] [security2:error] [pid 8849:tid 8849] [client 155.212.111.101:29341] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||tracdynamics.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tracdynamics.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agO-eAX3ZK-S3t5qC-USpgAAAAE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2025-12-04 07:19:44
UTC ·
(11 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 155.212.111.101 (FR/France/-): 1 in the last 3600 secs (0-196)
Hacking
🇫🇷
masterguru
2025-11-24 07:43:21
UTC ·
(11 months ago)
(FolderList) Hacking file access attemp in wordpress site from 155.212.111.101 (FR/France/-): 1 in the last 3600 secs (0-195)
Hacking
