🇺🇸
TPI-Abuse
2026-11-11 23:17:36
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:17:30.754835 2026] [security2:error] [pid 6739:tid 6739] [client 157.22.17.62:51941] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:17:30.754835 2026] [security2:error] [pid 6739:tid 6739] [client 157.22.17.62:51941] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.caferutadelaseda.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.caferutadelaseda.com"] [uri "/images/assets/assets/js/assets/owlcarousel/source/jquery.fancybox.css"] [unique_id "avT3iungstn2BevAxQLoMAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 11:48:35
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 06:48:26.916517 2026] [security2:error] [pid 16528:tid 16534] [client 157.22.17.62:49991] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 06:48:26.916517 2026] [security2:error] [pid 16528:tid 16534] [client 157.22.17.62:49991] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||financialcertified.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "financialcertified.com"] [uri "/Certified-Management-Consulting-Certification-Get-Board-Certified-Management-Consultant.html"] [unique_id "avRWClf7woU8YuWSUbt3GAAAAEM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
librebit
2026-11-09 06:24:54
UTC ·
(5 days ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-11-05 23:56:36
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 18:56:31.619861 2026] [security2:error] [pid 26014:tid 26014] [client 157.22.17.62:55851] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 18:56:31.619861 2026] [security2:error] [pid 26014:tid 26014] [client 157.22.17.62:55851] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2014/11/04/here-are-all-the-races-im-watching-closely-tonight/"] [unique_id "au0XryEFokxS4g3PV9B_JQAAAEE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-04 01:25:02
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 07:09:31
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 03:09:25.013821 2026] [security2:error] [pid 29042:tid 29042] [client 157.22.17.62:57791] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 03:09:25.013821 2026] [security2:error] [pid 29042:tid 29042] [client 157.22.17.62:57791] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ohwaitiforgot.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ohwaitiforgot.com"] [uri "/2014/02/18/2014-book-10-death-in-venice/"] [unique_id "auWUJYaQY1WabM45qsfmKwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 07:01:35
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 03:01:27.870658 2026] [security2:error] [pid 26273:tid 26273] [client 157.22.17.62:31891] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 03:01:27.870658 2026] [security2:error] [pid 26273:tid 26273] [client 157.22.17.62:31891] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.flavornet.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.flavornet.org"] [uri "/info/138-87-4.html"] [unique_id "auBMR8swJnkl9ztX-iR6jgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-27 04:35:39
UTC ·
(1 month ago)
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack t ...
show more
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack tools, blocked on sight. Please check the machine behind it. | method: POST | path: /xmlrpc.php | 2026-09-27 04:35 UTC
show less
Web App Attack
Hacking
🇪🇸
librebit
2026-06-23 01:40:24
UTC ·
(4 months ago)
Brute force
Brute-Force
🇪🇸
librebit
2026-06-21 06:40:41
UTC ·
(4 months ago)
Brute force
Brute-Force
🇩🇪
stinpriza
2026-05-31 09:43:44
UTC ·
(5 months ago)
Web App Attack
Web App Attack
🇺🇸
ambor
2026-05-30 09:00:48
UTC ·
(5 months ago)
Honeypot access: WordPress admin access attempt. Path: /wp-login.php
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 22:55:53
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 18:55:45.449323 2026] [security2:error] [pid 15572:tid 15572] [client 157.22.17.62:26015] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 18:55:45.449323 2026] [security2:error] [pid 15572:tid 15572] [client 157.22.17.62:26015] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||siczewicz.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "siczewicz.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahTTcUN0pXvkxyJefc3BrgAAAAY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 14:29:39
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 10:29:32.052162 2026] [security2:error] [pid 21322:tid 21322] [client 157.22.17.62:33533] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.17.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 10:29:32.052162 2026] [security2:error] [pid 21322:tid 21322] [client 157.22.17.62:33533] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||afdfurniture.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "afdfurniture.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahRczG1xxylh-hvMabkTGAAAAA4"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Hazzard
2026-03-31 21:26:41
UTC ·
(7 months ago)
(wordpress) Failed wordpress login from 157.22.17.62 (NL/The Netherlands/Drenthe/Oud Annerveen/-/[redacted]): (CF_ENABLE)
Brute-Force
