🇺🇸
TPI-Abuse
2026-11-10 15:07:02
UTC ·
(22 hours ago)
(mod_security) mod_security (id:210350) triggered by 157.22.127.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:06:59.563923 2026] [security2:error] [pid 18062:tid 18062] [client 157.22.127.30:49355] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.127.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:06:59.563923 2026] [security2:error] [pid 18062:tid 18062] [client 157.22.127.30:49355] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.losbarbarosdelnorte.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.losbarbarosdelnorte.com"] [uri "/conciencia/existen-los-dioses/"] [unique_id "avMzE0uiz5wN3wjFOzR-1AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 12:16:31
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.127.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 07:16:25.903762 2026] [security2:error] [pid 23344:tid 23344] [client 157.22.127.30:28589] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.127.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 07:16:25.903762 2026] [security2:error] [pid 23344:tid 23344] [client 157.22.127.30:28589] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/tags/370"] [unique_id "avBoGY0O8vP_dF-_pbMmNwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 02:17:04
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.127.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 21:16:57.805374 2026] [security2:error] [pid 2144:tid 2144] [client 157.22.127.30:31133] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.127.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 21:16:57.805374 2026] [security2:error] [pid 2144:tid 2144] [client 157.22.127.30:31133] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.themadwriter.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.themadwriter.us"] [uri "/hell-kill-us-all-9053.htm"] [unique_id "au_bmTVZLssGqSmhabN6vAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 08:05:46
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.127.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 04:05:42.342761 2026] [security2:error] [pid 2988:tid 2988] [client 157.22.127.30:32187] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.127.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 04:05:42.342761 2026] [security2:error] [pid 2988:tid 2988] [client 157.22.127.30:32187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2021/01/26/unlocked-jan-26-2021-the-1948-wall-st-strike-arsenal-for-democracy-ep-345/"] [unique_id "auRP1pTCBg6B2iQv_qqhWgAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 09:48:01
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.127.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 05:47:55.368724 2026] [security2:error] [pid 20783:tid 20783] [client 157.22.127.30:20463] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.127.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 05:47:55.368724 2026] [security2:error] [pid 20783:tid 20783] [client 157.22.127.30:20463] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.directoryofbikes.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.directoryofbikes.com"] [uri "/legal_notice.htm"] [unique_id "auHEy_FkAzTgYLnU4zluOQAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 17:59:43
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.127.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 13:59:39.490765 2026] [security2:error] [pid 27244:tid 27244] [client 157.22.127.30:60779] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.127.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 13:59:39.490765 2026] [security2:error] [pid 27244:tid 27244] [client 157.22.127.30:60779] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||borzoi-pedigree.batw.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "borzoi-pedigree.batw.net"] [uri "/recstore/l/LoralNadezhdar.html"] [unique_id "at5Di-czxp7wjnrKRJaJBwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
mrcrassi
2026-06-24 18:37:18
UTC ·
(4 months ago)
Triggered Cloudflare WAF (firewallCustom) from SE.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
T ...
show more
Triggered Cloudflare WAF (firewallCustom) from SE.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
LRob
2026-06-22 20:30:16
UTC ·
(4 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇮🇩
RasyiidWho
2026-04-20 18:15:53
UTC ·
(6 months ago)
ip112.20 . 157.22.127.30 - - [21/Apr/2026:01:15:52 +0700] "POST /xmlrpc.php HTTP/1.1" 401 172 "-" "Wget/1.21.4"
...
DDoS Attack
Brute-Force
Port Scan
Bad Web Bot
Web App Attack
SSH
🇫🇷
masterguru
2026-04-12 13:13:17
UTC ·
(6 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 157.22.127.30 (GB/United Kingdom/-): 1 in the last 3600 secs (0-195)
Hacking
