🇺🇸
TPI-Abuse
2026-11-11 13:21:15
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.101.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 08:21:10.795246 2026] [security2:error] [pid 7334:tid 7361] [client 157.22.101.142:23483] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.101.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 08:21:10.795246 2026] [security2:error] [pid 7334:tid 7361] [client 157.22.101.142:23483] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.killasgarage.bike|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.killasgarage.bike"] [uri "/uncategorized/whats-that-noise/"] [unique_id "avRrxifMilAIoKLo9DlqLwAAAVU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 07:16:10
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.101.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 02:16:04.313985 2026] [security2:error] [pid 28897:tid 28946] [client 157.22.101.142:56521] ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.101.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 02:16:04.313985 2026] [security2:error] [pid 28897:tid 28946] [client 157.22.101.142:56521] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.fishrapper.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fishrapper.com"] [uri "/article-wiggle-worm-walleye-101.html"] [unique_id "avFzNMUvZDQhFNRvThBD7AAAAZI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 14:13:35
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.101.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 09:13:29.074169 2026] [security2:error] [pid 25845:tid 25845] [client 157.22.101.142:64981] ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.101.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 09:13:29.074169 2026] [security2:error] [pid 25845:tid 25845] [client 157.22.101.142:64981] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||cometoorderva.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cometoorderva.com"] [uri "/taking-things-without-asking/"] [unique_id "avCDiWshBKfNjWiUB_6ChwAAAFM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 18:25:47
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.101.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 13:25:40.256136 2026] [security2:error] [pid 420:tid 420] [client 157.22.101.142:41423] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.101.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 13:25:40.256136 2026] [security2:error] [pid 420:tid 420] [client 157.22.101.142:41423] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/posts/8885"] [unique_id "aut4pMu5IRKhG0CBZQpcDQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 18:08:42
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.101.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 14:08:34.756582 2026] [security2:error] [pid 21528:tid 21528] [client 157.22.101.142:65071] ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.101.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 14:08:34.756582 2026] [security2:error] [pid 21528:tid 21528] [client 157.22.101.142:65071] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.steveyett.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.steveyett.com"] [uri "/new residence 3.htm"] [unique_id "atz0Iii4dUCy8Rcdbi315AAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-14 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-12 04:40:10
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
2026-08-07 18:28:25
UTC ·
(3 months ago)
[osotir.org] httpd-login-spray-site: sites=www.agonistes.gr; logs=/var/log/httpd/domains/agonistes.gr.log; samples=site_wide=true | distinct_ips=29 | /wp-login.php
Hacking
Web App Attack
