🇬🇷
setupgr
2026-11-12 12:37:35
UTC ·
(3 days ago)
(mod_security) mod_security (id:11000011) triggered by 157.100.198.55 (EC/Ecuador/Guayas/Guayaquil/-/[AS27947 Telconet S.A]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Thu Nov 12 14:37:32.175131 2026 ...
show more
(mod_security) mod_security (id:11000011) triggered by 157.100.198.55 (EC/Ecuador/Guayas/Guayaquil/-/[AS27947 Telconet S.A]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Thu Nov 12 14:37:32.175131 2026] [security2:error] [pid 1942342:tid 1942808] [client 157.100.198.55:50724] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "ecua.net.ec" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "140"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: host-157-100-198-55.ecua.net.ec"] [severity "CRITICAL"] [hostname "doityourself.gr"] [uri "/wp-content/plugins/justified-image-grid/timthumb.php"] [unique_id "avWzC15MdCo84_JycfIR1QAAAhI"], referer: https://google.com, https://doityourself.gr/%CF%86%CF%84%CE%B9%CE%AC%CF%87%CF%84%CE%BF-%CE%BC%CE%B1%CE%B6%CE%AF-%CE%BC%CE%B1%CF%82/
show less
Port Scan
🇫🇷
pcouy
2026-11-08 11:37:26
UTC ·
(1 week ago)
Obvious bot patterns with spoofed User-agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/19.0 Safari/605.1.15
...
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-30 04:16:19
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.100.198.55 (host-157-100-198-55.ecua.net.ec): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 00:16:15.148708 2026] [security2:error] [pid 14559:tid 14665] ...
show more
(mod_security) mod_security (id:210350) triggered by 157.100.198.55 (host-157-100-198-55.ecua.net.ec): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 00:16:15.148708 2026] [security2:error] [pid 14559:tid 14665] [client 157.100.198.55:42400] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||venezuelaguia.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "venezuelaguia.com"] [uri "/"] [unique_id "auQaD6UuNy1ywFTmKCAA7QAAAVY"], referer: https://five.co.in/redirect.php?ref_host=4agereversal.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-10-27 06:52:40
UTC ·
(2 weeks ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-10-01 17:21:08
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-25 03:05:57
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
🇺🇸
鬼影233
2026-09-25 02:25:18
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-24 16:13:05
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
🇺🇸
鬼影233
2026-09-24 14:19:29
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-11 20:04:23
UTC ·
(2 months ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Bad Web Bot
🇫🇷
Tilellit.PRO
2026-09-02 04:32:01
UTC ·
(2 months ago)
WooCommerce YITH AJAX Filder product_cat filter flood attempt with taxonomies
DDoS Attack
Bad Web Bot
🇩🇪
Inamin
2026-06-15 04:23:13
UTC ·
(5 months ago)
157.100.198.55 - - [15/Jun/2026:11:58:38 +0800] "GET /index.php?limit=500&target=%E7%AC%AC27%E5%9B%9E%E3%82%B9%E3%82%AF%E3%82%B9%E3%82%BF%E3%83%93%E3%83%83%E3%82%B0%E3%83%A9%E3%82%A4%E3%83%96&title=%E7%89%B9%E6%AE%8A%3A%E5%B7%B2%E9%80%A3%E7%B5%90%E7% ...
show more
157.100.198.55 - - [15/Jun/2026:11:58:38 +0800] "GET /index.php?limit=500&target=%E7%AC%AC27%E5%9B%9E%E3%82%B9%E3%82%AF%E3%82%B9%E3%82%BF%E3%83%93%E3%83%83%E3%82%B0%E3%83%A9%E3%82%A4%E3%83%96&title=%E7%89%B9%E6%AE%8A%3A%E5%B7%B2%E9%80%A3%E7%B5%90%E7%9A%84%E6%9C%80%E8%BF%91%E8%AE%8A%E6%9B%B4&userExpLevel=registered HTTP/2.0" 502 157 "-" "Opera/8.89.(Windows NT 5.0; ber-DZ) Presto/2.9.187 Version/12.00"
157.100.198.55 - - [15/Jun/2026:12:23:12 +0800] "GET /api.php?action=feedrecentchanges&days=7&feedformat=atom&from=20260506043414&hidebots=1&limit=50&target=%E5%A4%A9%E7%8E%8B%E5%AF%BA%E7%92%83%E5%A5%88%2F%E9%9B%A8%E3%81%AE%E4%B8%AD%E3%81%AE%E6%B6%99&urlversion=1&userExpLevel=unregistered HTTP/2.0" 502 559 "-" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/55.0.832.0 Safari/532.2"
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-03-05 05:00:44
UTC ·
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 157.100.198.55 (host-157-100-198-55.ecua.net.ec): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 05 00:00:38.325239 2026] [security2:error] [pid 1791:tid 1791] [ ...
show more
(mod_security) mod_security (id:210730) triggered by 157.100.198.55 (host-157-100-198-55.ecua.net.ec): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 05 00:00:38.325239 2026] [security2:error] [pid 1791:tid 1791] [client 157.100.198.55:23824] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||williamfitzsimmons.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "williamfitzsimmons.com"] [uri "/news/224-spring-solo-tour-new-album/citywinery.com"] [unique_id "aakN9siBxCf0xHpCSZ7f9QAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-02-24 22:50:53
UTC ·
(8 months ago)
scanning http requests from known botnet
Web App Attack
🇨🇭
backslash
2026-01-09 19:00:22
UTC ·
(10 months ago)
block ruleset A5EE6C8F745F0934168261886A3817E5C386412A
Bad Web Bot
