🇺🇸
TPI-Abuse
2026-11-09 08:52:59
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.47.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 03:52:54.007581 2026] [security2:error] [pid 9516:tid 9516] [client 157.22.47.120:17971] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.47.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 03:52:54.007581 2026] [security2:error] [pid 9516:tid 9516] [client 157.22.47.120:17971] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/tag/ndp-canada/"] [unique_id "avGJ5rY8lAwtI8nTN9g30wAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 01:42:18
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.47.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 21:42:14.956353 2026] [security2:error] [pid 4997:tid 4997] [client 157.22.47.120:22755] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.47.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 21:42:14.956353 2026] [security2:error] [pid 4997:tid 4997] [client 157.22.47.120:22755] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||painting-with-numbers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "painting-with-numbers.com"] [uri "/blog/ethical-presenter-2"] [unique_id "auVHdkvDvFSQxgyLUlFuvAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 12:59:32
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.47.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 08:59:28.674018 2026] [security2:error] [pid 5034:tid 5034] [client 157.22.47.120:54543] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.47.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 08:59:28.674018 2026] [security2:error] [pid 5034:tid 5034] [client 157.22.47.120:54543] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||truecontrarian.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "truecontrarian.com"] [uri "/stories/bio.htm"] [unique_id "atDOMO2mipC3JvDF3G5VgQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-24 07:26:08
UTC ·
(1 month ago)
[ti-01sc] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 157.22.47.120 - - [24/Sep/2026:09:25:23 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133. ...
show more
[ti-01sc] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 157.22.47.120 - - [24/Sep/2026:09:25:23 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
157.22.47.120 - - [24/Sep/2026:09:25:44 +0200] "POST /wp-login.php HTTP/2.0" 200 4486 "https://www.nieuwsvoordietisten.nl/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
157.22.47.120 - - [24/Sep/2026:09:25:45 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
157.22.47.120 - - [24/Sep/2026:09:26:02 +0200] "POST /wp-login.php HTTP/2.0" 200 4486 "https://www.nieuw
...
show less
Brute-Force
Web App Attack
🇩🇪
london2038.com
2026-06-12 07:13:36
UTC ·
(4 months ago)
Detected by WP fail2ban
2026-06-12T09:13:36.230738+02:00 wordpress: Authentication attempt from 157.22.47.120
Brute-Force
Web App Attack
🇩🇪
big-cloud.nl
2026-05-29 04:27:51
UTC ·
(5 months ago)
Try to access /xmlrpc.php
Web App Attack
🇫🇷
Tilellit.PRO
2026-05-21 20:49:12
UTC ·
(5 months ago)
Fail2Ban banned 157.22.47.120 for security violations in jail wp-armour. Log: 2026/05/21 20:49:12 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 157.22.47.120 | Target: wplogin" , client: 157.22.47.120, server: [REDACTED], request: ...
show more
Fail2Ban banned 157.22.47.120 for security violations in jail wp-armour. Log: 2026/05/21 20:49:12 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 157.22.47.120 | Target: wplogin" , client: 157.22.47.120, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇺🇸
interbiznw.com
2026-05-16 02:50:32
UTC ·
(5 months ago)
wordpress-bruteforce
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-05-11 18:52:45
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.47.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 14:52:42.353897 2026] [security2:error] [pid 30772:tid 30772] [client 157.22.47.120:42689] M ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.47.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 14:52:42.353897 2026] [security2:error] [pid 30772:tid 30772] [client 157.22.47.120:42689] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||neconebooks.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "neconebooks.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agIlekUgM2Vch8aYS28dkwAAACU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-11 01:19:31
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.47.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 21:19:27.348843 2026] [security2:error] [pid 11759:tid 11783] [client 157.22.47.120:42513] M ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.47.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 21:19:27.348843 2026] [security2:error] [pid 11759:tid 11783] [client 157.22.47.120:42513] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gryphix.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gryphix.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agEun7otv-JNHYVPoQmN_QAAAFY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-09 11:15:07
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.47.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 07:15:02.602261 2026] [security2:error] [pid 8979:tid 8979] [client 157.22.47.120:19245] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.47.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 07:15:02.602261 2026] [security2:error] [pid 8979:tid 8979] [client 157.22.47.120:19245] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||scala-global.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "scala-global.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af8XNmjKc0X84WU0Ma8wygAAAAA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-03-26 19:57:32
UTC ·
(7 months ago)
Detected attack and reported by a human
Brute-Force
Web App Attack
SSH
DDoS Attack
Exploited Host
Bad Web Bot
2026-01-15 20:39:41
UTC ·
(9 months ago)
2026-01-15T22:39:41.304911+02:00 zanati wp(www.sahpa.co.za)[2339832]: Blocked authentication attempt for LisaNcube from 157.22.47.120
...
Web App Attack
