🇺🇸
Zandro
2026-11-14 12:00:14
UTC ·
(17 hours ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-12 20:28:58
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 155.212.36.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:28:50.911623 2026] [security2:error] [pid 1958:tid 1958] [client 155.212.36.58:61669] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.36.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:28:50.911623 2026] [security2:error] [pid 1958:tid 1958] [client 155.212.36.58:61669] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jeromesupick.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jeromesupick.com"] [uri "/Pages/Seasons.html"] [unique_id "avYhgghKyErUmIo3dPMSVgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 06:15:29
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 155.212.36.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 01:15:25.700689 2026] [security2:error] [pid 19889:tid 19889] [client 155.212.36.58:56735] M ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.36.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 01:15:25.700689 2026] [security2:error] [pid 19889:tid 19889] [client 155.212.36.58:56735] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jerusalem-temple-today.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jerusalem-temple-today.com"] [uri "/for/viewtopic.php"] [unique_id "avVZffYCwD_Mday0R7jdVAAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 05:51:38
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 155.212.36.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 00:51:32.638145 2026] [security2:error] [pid 23463:tid 23463] [client 155.212.36.58:47881] M ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.36.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 00:51:32.638145 2026] [security2:error] [pid 23463:tid 23463] [client 155.212.36.58:47881] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.timelord2067.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.timelord2067.com"] [uri "/forums/index.php"] [unique_id "avVT5AAbtMzzs__5EnopRQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 20:23:51
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 155.212.36.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 16:23:46.970696 2026] [security2:error] [pid 25753:tid 25753] [client 155.212.36.58:52683] M ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.36.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 16:23:46.970696 2026] [security2:error] [pid 25753:tid 25753] [client 155.212.36.58:52683] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||gadgeteer.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "gadgeteer.net"] [uri "/"] [unique_id "at0T0tFKPdWpxsmPvOLZ9gAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 17:01:27
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 155.212.36.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 13:01:19.049409 2026] [security2:error] [pid 22646:tid 22646] [client 155.212.36.58:10129] M ...
show more
(mod_security) mod_security (id:210730) triggered by 155.212.36.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 13:01:19.049409 2026] [security2:error] [pid 22646:tid 22646] [client 155.212.36.58:10129] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||williamfitzsimmons.com|F|2"] [data ".songkick.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "williamfitzsimmons.com"] [uri "/news/0208-william-fitzsimmons-releases-lions/www.SONGKICK.COM"] [unique_id "atzkXx5SfvGEUduWBSf0tQAAAAM"], referer: https://williamfitzsimmons.com/news/0208-william-fitzsimmons-releases-lions/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-15 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-14 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-13 03:21:21
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 155.212.36.58
2026-09-13T05:07:58+02:00 vpn Access-Reject 'baktha' station: 155.212.36.58 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 155.212.36.58
2026-09-13T05:07:58+02:00 vpn Access-Reject 'baktha' station: 155.212.36.58 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
lp
2026-09-10 04:50:13
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 155.212.36.58
2026-09-10T05:57:02+02:00 vpn Access-Reject 'pınar' station: 155.212.36.58 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 155.212.36.58
2026-09-10T05:57:02+02:00 vpn Access-Reject 'pınar' station: 155.212.36.58 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇺🇸
agabeckov
2026-09-09 15:36:38
UTC ·
(2 months ago)
Fail2Ban detected brute-force attempt on Cisco Anyconnect
VPN IP
Brute-Force
🇩🇪
FD-IX
2026-08-20 10:19:38
UTC ·
(2 months ago)
Brute-force login attack detected by WordPress firewall.
Brute-Force
Web App Attack
🇷🇴
magefix
2026-07-31 04:31:00
UTC ·
(3 months ago)
Fraudulent orders placed through WooCommerce store using stolen/fake customer and payment information.
Fraud Orders
🇺🇸
TPI-Abuse
2026-04-03 12:12:30
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 155.212.36.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 08:12:26.134489 2026] [security2:error] [pid 8252:tid 8252] [client 155.212.36.58:59709] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 155.212.36.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 08:12:26.134489 2026] [security2:error] [pid 8252:tid 8252] [client 155.212.36.58:59709] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||adminconllc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "adminconllc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ac-uqj6E6xKHMaS85ais2AAAAAc"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
RasyiidWho
2026-03-30 23:15:22
UTC ·
(7 months ago)
ip112.20 . 155.212.36.58 - - [31/Mar/2026:06:15:20 +0700] "GET /wp-login.php HTTP/1.1" 404 146 "-" "curl/8.6.0"
...
DDoS Attack
Brute-Force
Port Scan
Bad Web Bot
Web App Attack
SSH
