🇺🇸
TPI-Abuse
2026-11-15 21:00:26
UTC ·
(15 minutes ago)
(mod_security) mod_security (id:210350) triggered by 157.22.19.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 16:00:18.647961 2026] [security2:error] [pid 29517:tid 29517] [client 157.22.19.172:41997] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.19.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 16:00:18.647961 2026] [security2:error] [pid 29517:tid 29517] [client 157.22.19.172:41997] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.jerusalem-korczak-home.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.jerusalem-korczak-home.com"] [uri "/11/11.html"] [unique_id "avodYjqKr9KsJEkDux8vUgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 10:31:04
UTC ·
(10 hours ago)
(mod_security) mod_security (id:210350) triggered by 157.22.19.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 05:31:00.152553 2026] [security2:error] [pid 27303:tid 27303] [client 157.22.19.172:28069] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.19.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 05:31:00.152553 2026] [security2:error] [pid 27303:tid 27303] [client 157.22.19.172:28069] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.oposicionesyconcursos.es|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.oposicionesyconcursos.es"] [uri "/buscador-publicidad-malaga.php"] [unique_id "avmJ5EIVrD3Pfqw6rHFNrgAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-12 12:00:14
UTC ·
(3 days ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-10 05:11:08
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.19.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 00:11:01.449576 2026] [security2:error] [pid 28029:tid 28029] [client 157.22.19.172:61479] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.19.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 00:11:01.449576 2026] [security2:error] [pid 28029:tid 28029] [client 157.22.19.172:61479] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||naacd.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "naacd.com"] [uri "/blog/2008/09/christian-conservative-radical.html"] [unique_id "avKnZS1OfcmW8PZSDc9r8QAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 07:36:00
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.19.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 02:35:54.304350 2026] [security2:error] [pid 31898:tid 31898] [client 157.22.19.172:46307] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.19.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 02:35:54.304350 2026] [security2:error] [pid 31898:tid 31898] [client 157.22.19.172:46307] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.nwtree.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.nwtree.com"] [uri "/blog/12-amazing-animals-that-live-in-portlands-trees/"] [unique_id "avAmWuG_43rKB29rxCBlkgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 18:02:37
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.19.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 13:02:29.708686 2026] [security2:error] [pid 32542:tid 32542] [client 157.22.19.172:50283] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.19.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 13:02:29.708686 2026] [security2:error] [pid 32542:tid 32542] [client 157.22.19.172:50283] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||painting-with-numbers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "painting-with-numbers.com"] [uri "/blog/your-health-insurance-a-hidden-premium-increase"] [unique_id "aud-tYQzv1bdhitQP7ypLQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 14:10:42
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.19.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 10:10:37.824904 2026] [security2:error] [pid 7408:tid 7408] [client 157.22.19.172:32257] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.19.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 10:10:37.824904 2026] [security2:error] [pid 7408:tid 7408] [client 157.22.19.172:32257] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.flavornet.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.flavornet.org"] [uri "/info/693-95-8.html"] [unique_id "auSlXakJVVVoc97Qph4juQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
bittiguru.fi
2026-09-24 10:05:23
UTC ·
(1 month ago)
157.22.19.172 - [24/Sep/2026:13:04:27 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" "4.66"
157.22.19.172 - [24/Sep/2026:13:05:2 ...
show more
157.22.19.172 - [24/Sep/2026:13:04:27 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" "4.66"
157.22.19.172 - [24/Sep/2026:13:05:22 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "4.66"
...
show less
Hacking
Brute-Force
Web App Attack
🇺🇸
paulo.apoloni
2026-05-26 14:32:50
UTC ·
(5 months ago)
157.22.19.172 - - [26/May/2026:11:32:47 -0300] "POST /admin/login/xmlrpc.php HTTP/1.1" 302 0 "-" "curl/8.6.0"
157.22.19.172 - - [26/May/2026:11:32:48 -0300] "POST /Auth/Login?ReturnUrl=%2Fadmin%2Flogin%2Fxmlrpc.php HTTP/1.1" 400 0 "-" "Wget/1.21.4"
1 ...
show more
157.22.19.172 - - [26/May/2026:11:32:47 -0300] "POST /admin/login/xmlrpc.php HTTP/1.1" 302 0 "-" "curl/8.6.0"
157.22.19.172 - - [26/May/2026:11:32:48 -0300] "POST /Auth/Login?ReturnUrl=%2Fadmin%2Flogin%2Fxmlrpc.php HTTP/1.1" 400 0 "-" "Wget/1.21.4"
157.22.19.172 - - [26/May/2026:11:32:48 -0300] "POST /admin/login/xmlrpc.php HTTP/1.1" 302 0 "-" "curl/7.88.1"
157.22.19.172 - - [26/May/2026:11:32:49 -0300] "POST /Auth/Login?ReturnUrl=%2Fadmin%2Flogin%2Fxmlrpc.php HTTP/1.1" 400 0 "-" "Wget/1.21.4"
157.22.19.172 - - [26/May/2026:11:32:49 -0300] "POST /admin/login/xmlrpc.php HTTP/1.1" 302 0 "-" "curl/7.88.1"
...
show less
Web App Attack
2026-03-13 12:56:03
UTC ·
(8 months ago)
Web App Attack
Brute-Force
Web App Attack
🇩🇪
kjaerulff
2026-03-11 14:53:43
UTC ·
(8 months ago)
Failed Wordpress login using wp-login.php
Web App Attack
🇨🇭
backslash
2026-02-27 06:12:00
UTC ·
(8 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇮🇹
VHosting
2026-02-24 12:45:10
UTC ·
(8 months ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇩🇪
LRob
2026-02-22 06:00:19
UTC ·
(8 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
