🇺🇸
TPI-Abuse
2026-11-09 02:23:43
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 21:23:37.047613 2026] [security2:error] [pid 28587:tid 28587] [client 157.22.102.145:30883] ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 21:23:37.047613 2026] [security2:error] [pid 28587:tid 28587] [client 157.22.102.145:30883] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/tags/1439"] [unique_id "avEuqVJnhBlfsQp9id5tQAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 12:21:12
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 08:21:06.445437 2026] [security2:error] [pid 26811:tid 26811] [client 157.22.102.145:46373] ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 08:21:06.445437 2026] [security2:error] [pid 26811:tid 26811] [client 157.22.102.145:46373] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.jerusalem-korczak-home.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.jerusalem-korczak-home.com"] [uri "/yarm/yarm.html"] [unique_id "auSLspAjFXCcka3rug8sngAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 17:50:38
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 13:50:33.701398 2026] [security2:error] [pid 24060:tid 24060] [client 157.22.102.145:18859] ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 13:50:33.701398 2026] [security2:error] [pid 24060:tid 24060] [client 157.22.102.145:18859] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||persnicketyinc.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "persnicketyinc.com"] [uri "/tag/napkins-custom/"] [unique_id "at5Bae8WsyE81_9uf5m2ZwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 03:29:24
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 23:29:16.715060 2026] [security2:error] [pid 17266:tid 17266] [client 157.22.102.145:39083] ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 23:29:16.715060 2026] [security2:error] [pid 17266:tid 17266] [client 157.22.102.145:39083] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||wintercypher.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "wintercypher.com"] [uri "/"] [unique_id "at13jGwcawIeDfNO5A3DhQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
bittiguru.fi
2026-09-23 06:15:54
UTC ·
(1 month ago)
157.22.102.145 - [23/Sep/2026:09:09:46 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" "4.66"
157.22.102.145 - [23/Sep/2026:09:15 ...
show more
157.22.102.145 - [23/Sep/2026:09:09:46 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" "4.66"
157.22.102.145 - [23/Sep/2026:09:15:53 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" "4.66"
...
show less
Hacking
Brute-Force
Web App Attack
🇧🇪
voormedia
2026-04-27 14:38:05
UTC ·
(6 months ago)
Accessed trap at '/xmlrpc.php'
Web App Attack
🇺🇸
TPI-Abuse
2026-04-27 11:58:10
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 07:58:05.555755 2026] [security2:error] [pid 22776:tid 22776] [client 157.22.102.145:42211] ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 07:58:05.555755 2026] [security2:error] [pid 22776:tid 22776] [client 157.22.102.145:42211] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||braddonengineering.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "braddonengineering.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ae9PTUU4zN-EUvrOhEmQxAAAAAY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-26 08:08:10
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 04:08:04.307844 2026] [security2:error] [pid 5404:tid 5404] [client 157.22.102.145:41619] M ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 04:08:04.307844 2026] [security2:error] [pid 5404:tid 5404] [client 157.22.102.145:41619] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||marlinlee.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "marlinlee.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ae3H5L1lCJ-1Nyqc9_NkCAAAACI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-24 12:10:11
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 24 08:10:04.607222 2026] [security2:error] [pid 574514:tid 574514] [client 157.22.102.145:3578 ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.102.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 24 08:10:04.607222 2026] [security2:error] [pid 574514:tid 574514] [client 157.22.102.145:35789] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||solidthought.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "solidthought.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aetdnKpszYzWtXTyC6TrTgAAABs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ambor
2026-04-17 14:55:31
UTC ·
(6 months ago)
Honeypot access: WordPress admin access attempt. Path: /wp-login.php
Brute-Force
Web App Attack
