🇺🇸
TPI-Abuse
2026-03-06 11:57:12
(5 months ago)
(mod_security) mod_security (id:210350) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 06 06:57:04.788262 2026] [security2:error] [pid 32384:tid 32384] [client 156.239.209.211:52966] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.staben.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.staben.com"] [uri "/wp-login.php"] [unique_id "aarBEF6jF54bpTzlJYokfgAAAAk"], referer: https://www.staben.com/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-01-23 10:30:06
(7 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2026-01-14 18:19:55
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 13:19:46.191322 2026] [security2:error] [pid 3413765:tid 3413765] [client 156.239.209.211:11904] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.mavikalem.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.mavikalem.org"] [uri "/wp-login.php"] [unique_id "aWfeQnL4RyUKm3PWRUgN_QAAAAE"], referer: https://www.mavikalem.org/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-06 10:30:25
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 06 05:30:20.885492 2026] [security2:error] [pid 16016:tid 16016] [client 156.239.209.211:44256] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.firstunitedreserve.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.firstunitedreserve.com"] [uri "/wp-login.php"] [unique_id "aVzkPMGAFebKYoo8xORQpAAAAAA"], referer: https://www.firstunitedreserve.com/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Packets-Decreaser.NET
2025-12-31 00:57:07
(8 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇩🇪
F242
2025-12-03 03:45:23
(8 months ago)
Wordpress Login or XMLRPC abuse
Web App Attack
🇨🇦
4everEvolving WPM
2025-11-24 16:31:00
(9 months ago)
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2025-11-23 17:21:24
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 12:21:19.847493 2025] [security2:error] [pid 4226:tid 4226] [client 156.239.209.211:55333] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||salernospizza.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "salernospizza.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aSNCj__t__YK1k56hKTC7QAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
4everEvolving WPM
2025-11-23 06:43:00
(9 months ago)
Failed log in attempts
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2025-11-19 07:49:52
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 19 02:49:46.155042 2025] [security2:error] [pid 25197:tid 25197] [client 156.239.209.211:55353] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||tortoisehosting.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tortoisehosting.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aR12muFQBi9yoMhw5zaxuQAAAAk"], referer: https://tortoisehosting.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-17 02:12:29
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 16 21:12:24.982350 2025] [security2:error] [pid 7668:tid 7668] [client 156.239.209.211:32487] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||realclean.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "realclean.net"] [uri "/wp-json/wp/v2/users/"] [unique_id "aRqEiIHK8pwx1dZxJoqc0gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
hostseries
2025-10-01 12:51:27
(10 months ago)
Trigger: LF_DISTATTACK
Brute-Force
2025-07-31 08:47:43
(1 year ago)
Attempted brute force login to web vpn 4 time(s); last attempt for 2025.07.31 is noted in report tim ...
show more
Attempted brute force login to web vpn 4 time(s); last attempt for 2025.07.31 is noted in report timestamp
show less
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2025-06-30 16:37:23
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.239.209.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 30 12:37:19.543412 2025] [security2:error] [pid 20973:tid 20973] [client 156.239.209.211:57335] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bohk.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bohk.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aGK9P-Xym3YYZgd12QNeEQAAACE"], referer: https://bohk.com
show less
Brute-Force
Bad Web Bot
Web App Attack