🇺🇸
TPI-Abuse
2026-02-14 09:15:15
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 156.239.205.54 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 156.239.205.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 04:15:12.115999 2026] [security2:error] [pid 4116086:tid 4116086] [client 156.239.205.54:32716] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jolankagroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jolankagroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aZA9IFvrST1xRpH9ne3gAwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-28 10:16:22
(8 months ago)
(mod_security) mod_security (id:210350) triggered by 156.239.205.54 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 156.239.205.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 28 05:16:18.060411 2026] [security2:error] [pid 26586:tid 26586] [client 156.239.205.54:42238] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||harwoodmechanical.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "harwoodmechanical.com"] [uri "/wp-login.php"] [unique_id "aXnh8vWyC2mMGuhmUGyFXwAAAAA"], referer: https://harwoodmechanical.com/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-01-27 09:17:10
(8 months ago)
wordpress-trap
Web App Attack
🇺🇸
etu brutus
2026-01-17 19:34:49
(8 months ago)
156.239.205.54 has been banned for [WebApp Attack]
...
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-10 00:31:22
(9 months ago)
(mod_security) mod_security (id:210350) triggered by 156.239.205.54 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 156.239.205.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 09 19:31:15.415828 2026] [security2:error] [pid 17839:tid 17839] [client 156.239.205.54:43844] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||iconconstructors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "iconconstructors.com"] [uri "/wp-login.php"] [unique_id "aWGd07YPZ7yhrrKdLIyUDgAAAAU"], referer: http://iconconstructors.com/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
F242
2025-12-02 22:05:17
(10 months ago)
Wordpress Login or XMLRPC abuse
Web App Attack
🇺🇸
TPI-Abuse
2025-11-22 07:03:44
(10 months ago)
(mod_security) mod_security (id:210350) triggered by 156.239.205.54 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 156.239.205.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 22 02:03:39.449126 2025] [security2:error] [pid 13918:tid 13918] [client 156.239.205.54:32307] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jolankagroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jolankagroup.com"] [uri "/wp-login.php"] [unique_id "aSFgSyHDL-VAMPxe9-nQgAAAAAk"], referer: http://jolankagroup.com/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇳
Yashgarg@123
2025-10-21 05:51:36
(11 months ago)
DDoS and brute force activity detected
Brute-Force
SSH
2025-07-31 18:57:10
(1 year ago)
Attempted brute force login to web vpn 5 time(s); last attempt for 2025.07.31 is noted in report tim ...
show more
Attempted brute force login to web vpn 5 time(s); last attempt for 2025.07.31 is noted in report timestamp
show less
Hacking
Brute-Force
🇮🇳
wizard1411
2025-06-15 16:30:40
(1 year ago)
DDoS and brute force activity detected
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-06-09 17:45:39
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 156.239.205.54 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 156.239.205.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 09 13:45:35.352821 2025] [security2:error] [pid 3330289:tid 3330289] [client 156.239.205.54:58025] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||iostation.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "iostation.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aEcdv1CR4Qg5XbeRyIurtwAAAAo"], referer: https://iostation.com
show less
Brute-Force
Bad Web Bot
Web App Attack