🇺🇸
TPI-Abuse
2026-02-11 23:31:01
(8 months ago)
(mod_security) mod_security (id:210350) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 11 18:30:54.371005 2026] [security2:error] [pid 2304:tid 2304] [client 156.239.209.147:41218] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lawrencehale.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lawrencehale.com"] [uri "/wp-login.php"] [unique_id "aY0RLksS8wjdZ5o_vK7LcAAAAAI"], referer: https://lawrencehale.com/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
mrcrassi
2026-01-01 20:42:45
(9 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST meth ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
Packets-Decreaser.NET
2025-12-31 00:59:47
(9 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
TPI-Abuse
2025-12-24 14:16:41
(9 months ago)
(mod_security) mod_security (id:210350) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 24 09:16:38.022118 2025] [security2:error] [pid 32325:tid 32325] [client 156.239.209.147:13550] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.firstunitedreserve.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.firstunitedreserve.com"] [uri "/wp-login.php"] [unique_id "aUv1xk56qZhvZN_EFSq1zQAAAAg"], referer: https://www.firstunitedreserve.com/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
thetomtaylor.co.uk
2025-12-16 17:22:25
(9 months ago)
Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer
... [wa01]
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-07 22:28:18
(10 months ago)
(mod_security) mod_security (id:210350) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 17:28:13.335538 2025] [security2:error] [pid 30113:tid 30113] [client 156.239.209.147:35406] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.centrodentalsindolor.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.centrodentalsindolor.com"] [uri "/wp-login.php"] [unique_id "aTX_fR06Ew_QBM7FJ-o0ywAAABI"], referer: https://www.centrodentalsindolor.com/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-12-03 20:06:19
(10 months ago)
botnet
DDoS Attack
🇺🇸
TPI-Abuse
2025-11-27 00:23:04
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 19:22:58.691164 2025] [security2:error] [pid 13468:tid 13468] [client 156.239.209.147:46815] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.abundancecompany.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.abundancecompany.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aSeZ4jr68yWHZyoG_bMnkQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-19 02:57:38
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 18 21:57:32.311967 2025] [security2:error] [pid 3579389:tid 3579389] [client 156.239.209.147:12093] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||grandpont-house.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "grandpont-house.org"] [uri "/wp-json/wp/v2/users/"] [unique_id "aR0yHImCPHbGYktNLxJ_fgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-17 18:22:07
(10 months ago)
(mod_security) mod_security (id:210350) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 17 13:22:02.717260 2025] [security2:error] [pid 23336:tid 23336] [client 156.239.209.147:44731] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||bernsteinip.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bernsteinip.com"] [uri "/wp-login.php"] [unique_id "aRtnyppeQSGKjU3yWZVmzwAAAAE"], referer: https://bernsteinip.com/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2025-11-17 12:51:13
(10 months ago)
Web password guessing
Brute-Force
🇺🇸
TPI-Abuse
2025-11-16 23:44:05
(10 months ago)
(mod_security) mod_security (id:210350) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 156.239.209.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 16 18:43:59.581632 2025] [security2:error] [pid 670:tid 670] [client 156.239.209.147:9859] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jolankagroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jolankagroup.com"] [uri "/wp-login.php"] [unique_id "aRphv9UfY1ldAs9xiISP4AAAAAw"], referer: http://jolankagroup.com/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ps-center
2025-09-07 08:04:18
(1 year ago)
C1: Web Attack POST /wp-login.php
Web Spam
Hacking
Bad Web Bot
Web App Attack
2025-07-31 10:21:50
(1 year ago)
Attempted brute force login to web vpn 4 time(s); last attempt for 2025.07.31 is noted in report tim ...
show more
Attempted brute force login to web vpn 4 time(s); last attempt for 2025.07.31 is noted in report timestamp
show less
Hacking
Brute-Force
🇮🇳
wizard1411
2025-06-14 16:55:39
(1 year ago)
DDoS and brute force activity detected
Brute-Force
SSH