🇺🇸
TPI-Abuse
2026-11-10 16:11:25
UTC ·
(8 hours ago)
(mod_security) mod_security (id:210350) triggered by 155.212.36.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 11:11:22.216871 2026] [security2:error] [pid 15426:tid 15426] [client 155.212.36.86:20407] M ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.36.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 11:11:22.216871 2026] [security2:error] [pid 15426:tid 15426] [client 155.212.36.86:20407] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.misscharlottemusic.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.misscharlottemusic.com"] [uri "/yourweeklylisten/wp-json/oembed/1.0/embed"] [unique_id "avNCKra6eAZggzuhWrcSEQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 14:38:36
UTC ·
(10 hours ago)
(mod_security) mod_security (id:210350) triggered by 155.212.36.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:38:29.695009 2026] [security2:error] [pid 5875:tid 5875] [client 155.212.36.86:63907] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.36.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:38:29.695009 2026] [security2:error] [pid 5875:tid 5875] [client 155.212.36.86:63907] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||natural-history-conservation.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "natural-history-conservation.com"] [uri "/norfolkichthyosaur.htm"] [unique_id "avMsZXbJ07eCdBTg4f_0twAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 10:28:57
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 155.212.36.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 06:28:51.198704 2026] [security2:error] [pid 19530:tid 19530] [client 155.212.36.86:49723] M ...
show more
(mod_security) mod_security (id:210350) triggered by 155.212.36.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 06:28:51.198704 2026] [security2:error] [pid 19530:tid 19530] [client 155.212.36.86:49723] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||guardmagic.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "guardmagic.com"] [uri "/rus/042r-solution-in-brief/03r-tankermonitoring/00r-tankermonitoring.htm"] [unique_id "auRxY-MPqoC1lwBA7vrA2gAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-27 04:38:01
UTC ·
(1 month ago)
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack t ...
show more
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack tools, blocked on sight. Please check the machine behind it. | method: GET | path: /wp-login.php | 2026-09-27 04:38 UTC
show less
Web App Attack
Hacking
🇨🇿
Countryman
2026-09-14 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-12 01:50:00
UTC ·
(1 month ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 155.212.36.86
2026-09-12T02:44:19+02:00 vpn Access-Reject 'nuwakot' station: 155.212.36.86 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacte ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 155.212.36.86
2026-09-12T02:44:19+02:00 vpn Access-Reject 'nuwakot' station: 155.212.36.86 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
lp
2026-09-09 00:21:21
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 3 attempts were recorded from 155.212.36.86
2026-09-09T01:53:41+02:00 vpn Access-Reject 'klaudia' station: 155.212.36.86 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacte ...
show more
Unauthorized VPN login attempts: 3 attempts were recorded from 155.212.36.86
2026-09-09T01:53:41+02:00 vpn Access-Reject 'klaudia' station: 155.212.36.86 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-09T01:55:05+02:00 vpn Access-Reject 'c3' station: 155.212.36.86 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-09T01:56:22+02:00 vpn Access-Reject 'dawood' station: 155.212.36.86 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇩🇪
FD-IX
2026-09-03 14:16:26
UTC ·
(2 months ago)
Brute-force login attack detected by WordPress firewall.
Brute-Force
Web App Attack
2026-08-10 06:24:45
UTC ·
(3 months ago)
[ns41.kdns.gr] httpd-ioc-ua: sites=www.monastiria.gr; logs=/var/log/httpd/domains/monastiria.gr.log; samples=wp2shell ua=wp2shell /wp-json/
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 21:18:12
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 155.212.36.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 17:18:06.100965 2026] [security2:error] [pid 4938:tid 4938] [client 155.212.36.86:36937] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 155.212.36.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 17:18:06.100965 2026] [security2:error] [pid 4938:tid 4938] [client 155.212.36.86:36937] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||kippert.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "kippert.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af5TDnZ_cUERoTV5R_AfXQAAAAU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2025-12-31 09:41:34
UTC ·
(10 months ago)
Multiple WAF Violations
Brute-Force
Web App Attack
