🇺🇸
TPI-Abuse
2026-11-10 11:22:25
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:22:20.364618 2026] [security2:error] [pid 28538:tid 28538] [client 157.22.17.147:62753] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:22:20.364618 2026] [security2:error] [pid 28538:tid 28538] [client 157.22.17.147:62753] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.joeordie.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.joeordie.com"] [uri "/utcztrfofp/of-401090.html"] [unique_id "avL-bEp0QYIntlwHiIEHXgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 05:48:03
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 00:47:55.823475 2026] [security2:error] [pid 15927:tid 15927] [client 157.22.17.147:48045] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 00:47:55.823475 2026] [security2:error] [pid 15927:tid 15927] [client 157.22.17.147:48045] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.jerusalem-korczak-home.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.jerusalem-korczak-home.com"] [uri "/bib/SemOst/SemOst.html"] [unique_id "au1qC50oXdflDEuKE_eiPgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 09:48:52
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 04:48:45.635135 2026] [security2:error] [pid 21390:tid 21390] [client 157.22.17.147:28991] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 04:48:45.635135 2026] [security2:error] [pid 21390:tid 21390] [client 157.22.17.147:28991] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.vrbsroma.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.vrbsroma.com"] [uri "/article2.html"] [unique_id "auxQ_RcHtm6VXd5wbDYDvgAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 23:49:29
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 19:49:25.218380 2026] [security2:error] [pid 32114:tid 32114] [client 157.22.17.147:31135] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 19:49:25.218380 2026] [security2:error] [pid 32114:tid 32114] [client 157.22.17.147:31135] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.grupo-visalud.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.grupo-visalud.com"] [uri "/2024/06/steroids-what-is-their-impact-on-the-body/"] [unique_id "auKKBW4OZdCTFE3j33culgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 16:51:46
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 12:51:41.732049 2026] [security2:error] [pid 3058:tid 3058] [client 157.22.17.147:53699] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 12:51:41.732049 2026] [security2:error] [pid 3058:tid 3058] [client 157.22.17.147:53699] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||sarahwhitecotton.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "sarahwhitecotton.com"] [uri "/resume.html"] [unique_id "auIoHULPktz_W4fA1u63ggAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-26 00:16:18
UTC ·
(4 months ago)
[Fri Jun 26 10:16:17.955279 2026] [security2:error] [pid 594152] [client 157.22.17.147:13553] [client 157.22.17.147] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Fri Jun 26 10:16:17.955279 2026] [security2:error] [pid 594152] [client 157.22.17.147:13553] [client 157.22.17.147] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/xmlrpc.php"] [unique_id "aj3E0VPn7oYHjXR4KbH0FQAAAA4"]
...
show less
Web App Attack
🇺🇸
Jason Howell
2026-06-10 21:12:43
UTC ·
(5 months ago)
157.22.17.147 - - [10/Jun/2026:16:12:37 -0500] "GET /wp-login.php HTTP/1.1" 301 570 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10"
157.22.17.147 - - [10/Jun/2026:16:12:38 ...
show more
157.22.17.147 - - [10/Jun/2026:16:12:37 -0500] "GET /wp-login.php HTTP/1.1" 301 570 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10"
157.22.17.147 - - [10/Jun/2026:16:12:38 -0500] "GET /wp-login.php HTTP/1.1" 200 6347 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10"
157.22.17.147 - - [10/Jun/2026:16:12:39 -0500] "POST /wp-login.php HTTP/1.1" 200 2979 "https://lhrareenacting.com/wp-login.php" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10"
157.22.17.147 - - [10/Jun/2026:16:12:40 -0500] "GET /wp-login.php HTTP/1.1" 301 570 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10"
157.22.17.147 - - [10/Jun/2026:16:12:40 -0500] "GET /wp-login.php HTTP/1.1" 200 2619 "-" "Mozilla/5.0 (Windows; U; Wind
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-04-29 14:27:06
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 10:27:00.481412 2026] [security2:error] [pid 10314:tid 10314] [client 157.22.17.147:40049] M ...
show more
(mod_security) mod_security (id:210730) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 10:27:00.481412 2026] [security2:error] [pid 10314:tid 10314] [client 157.22.17.147:40049] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.epicjellyfish.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.epicjellyfish.com"] [uri "/s3cmd.ini"] [unique_id "afIVNJ1sCPqnIroxbUdj3AAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-29 07:48:38
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 03:48:35.500345 2026] [security2:error] [pid 24709:tid 24709] [client 157.22.17.147:62103] M ...
show more
(mod_security) mod_security (id:210730) triggered by 157.22.17.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 03:48:35.500345 2026] [security2:error] [pid 24709:tid 24709] [client 157.22.17.147:62103] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tupansetc.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tupansetc.com"] [uri "/s3cmd.ini"] [unique_id "afG305XUE8hEy6kw5mOWwgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-04-29 06:51:32
UTC ·
(6 months ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 157.22.17.147 (NL/The Netherlands/-): 1 in the last 3600 secs (0-195)
Hacking
🇩🇪
big-cloud.nl
2026-04-26 03:04:47
UTC ·
(6 months ago)
Try to access /.aws/credentials
Web App Attack
