🇺🇸
TPI-Abuse
2026-11-13 15:38:09
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.127.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:38:03.765182 2026] [security2:error] [pid 20824:tid 20824] [client 157.22.127.62:60253] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.127.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:38:03.765182 2026] [security2:error] [pid 20824:tid 20824] [client 157.22.127.62:60253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cbcfargo.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cbcfargo.com"] [uri "/site/Resources/devotionals/2025-11-09.php"] [unique_id "avcu2zSf4AdofPYPYnROogAAAEc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 15:20:30
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.127.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 11:20:26.275915 2026] [security2:error] [pid 26615:tid 26615] [client 157.22.127.62:29259] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.127.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 11:20:26.275915 2026] [security2:error] [pid 26615:tid 26615] [client 157.22.127.62:29259] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ohwaitiforgot.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ohwaitiforgot.com"] [uri "/2011/02/16/2011-book-11-labyrinths/"] [unique_id "auS1uvDn6Hcx7v91W_p-awAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 11:19:43
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.127.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 07:19:37.885922 2026] [security2:error] [pid 10606:tid 10606] [client 157.22.127.62:27569] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.127.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 07:19:37.885922 2026] [security2:error] [pid 10606:tid 10606] [client 157.22.127.62:27569] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.painting-with-numbers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.painting-with-numbers.com"] [uri "/blog/big-kahuna"] [unique_id "auMrybnmMMVB2HckoWeWywAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-26 20:18:23
UTC ·
(2 weeks ago)
WordPress attack-tool calls | method: POST | path: /xmlrpc.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0
Web App Attack
Hacking
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
agabeckov
2026-09-12 00:07:53
UTC ·
(2 months ago)
Fail2Ban detected brute-force attempt on Cisco Anyconnect
VPN IP
Brute-Force
🇨🇿
lp
2026-09-11 00:21:39
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 157.22.127.62
2026-09-11T00:46:09+02:00 vpn Access-Reject 'kpike' station: 157.22.127.62 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted> ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 157.22.127.62
2026-09-11T00:46:09+02:00 vpn Access-Reject 'kpike' station: 157.22.127.62 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-26 01:41:59
UTC ·
(4 months ago)
[Fri Jun 26 11:41:59.137180 2026] [security2:error] [pid 604156] [client 157.22.127.62:29103] [client 157.22.127.62] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Fri Jun 26 11:41:59.137180 2026] [security2:error] [pid 604156] [client 157.22.127.62:29103] [client 157.22.127.62] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/xmlrpc.php"] [unique_id "aj3Y5wegtY-KiZsVnHoSWQAAAAU"]
...
show less
Web App Attack
