🇺🇸
TPI-Abuse
2026-11-15 08:32:45
UTC ·
(14 minutes ago)
(mod_security) mod_security (id:210350) triggered by 157.22.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 03:32:40.459202 2026] [security2:error] [pid 29255:tid 29255] [client 157.22.47.228:59389] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 03:32:40.459202 2026] [security2:error] [pid 29255:tid 29255] [client 157.22.47.228:59389] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2013/09/03/afd-55-college-costs/www.nytimes.com/2013/09/01/opinion/sunday/squirrel-power.html"] [unique_id "avluKG4yYfI8F36vhLD2IQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 02:55:36
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210350) triggered by 157.22.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 21:55:31.432204 2026] [security2:error] [pid 7956:tid 7956] [client 157.22.47.228:30589] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 21:55:31.432204 2026] [security2:error] [pid 7956:tid 7956] [client 157.22.47.228:30589] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.hacertests.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.hacertests.com"] [uri "/examenes-11370-AV3R_SI_M3_CONOC3N.php"] [unique_id "avkfIya_C-4DvZwBeN9TfQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 03:35:33
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 22:35:28.560875 2026] [security2:error] [pid 29783:tid 29783] [client 157.22.47.228:36601] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 22:35:28.560875 2026] [security2:error] [pid 29783:tid 29783] [client 157.22.47.228:36601] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||persnicketyinc.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "persnicketyinc.com"] [uri "/fifty-shades-of-gray/"] [unique_id "avPigF44sj946jjyuPIDVgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
afleventoffice.com.au
2026-11-09 06:08:01
UTC ·
(6 days ago)
GET /essendon-v-north-melbourne HTTP/1.1
Web App Attack
🇪🇸
librebit
2026-11-09 04:49:44
UTC ·
(6 days ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-11-08 11:18:09
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 06:18:02.187319 2026] [security2:error] [pid 1897:tid 1897] [client 157.22.47.228:52211] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 06:18:02.187319 2026] [security2:error] [pid 1897:tid 1897] [client 157.22.47.228:52211] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.watonga.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.watonga.com"] [uri "/biblebios/lot/bekanntschaft-leo/"] [unique_id "avBaarijbFSG-kFvQZFcSQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-08 01:34:56
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇨🇿
Countryman
2026-09-15 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-14 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
agabeckov
2026-09-12 18:11:38
UTC ·
(2 months ago)
Fail2Ban detected brute-force attempt on Cisco Anyconnect
VPN IP
Brute-Force
🇨🇿
lp
2026-09-11 06:21:37
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 2 attempts were recorded from 157.22.47.228
2026-09-11T08:04:38+02:00 vpn Access-Reject 'NirvanChackoor' station: 157.22.47.228 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '< ...
show more
Unauthorized VPN login attempts: 2 attempts were recorded from 157.22.47.228
2026-09-11T08:04:38+02:00 vpn Access-Reject 'NirvanChackoor' station: 157.22.47.228 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-11T08:06:17+02:00 vpn Access-Reject 'PatrickJuliette' station: 157.22.47.228 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇺🇸
TRoden
2026-08-11 12:42:51
UTC ·
(3 months ago)
Geo Block Plugin: Escalation flag(s): rce_attempt
Hacking
2026-07-30 13:23:02
UTC ·
(3 months ago)
RdpGuard detected brute-force attempt on RD-WEB
Brute-Force
🇫🇷
masterguru
2026-04-07 09:31:39
UTC ·
(7 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 157.22.47.228 (DE/Germany/-): 1 in the last 3600 secs (0-196)
Hacking
🇺🇸
TPI-Abuse
2026-02-25 21:43:11
UTC ·
(8 months ago)
(mod_security) mod_security (id:210350) triggered by 157.22.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 25 16:43:03.797379 2026] [security2:error] [pid 9704:tid 9704] [client 157.22.47.228:53557] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 25 16:43:03.797379 2026] [security2:error] [pid 9704:tid 9704] [client 157.22.47.228:53557] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||g-h2o.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "g-h2o.com"] [uri "/"] [unique_id "aZ9s54yPJK3JyFu85IP3uAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
