🇺🇸
TPI-Abuse
2026-11-11 14:08:57
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 09:08:51.259079 2026] [security2:error] [pid 17309:tid 17309] [client 157.22.72.155:52655] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 09:08:51.259079 2026] [security2:error] [pid 17309:tid 17309] [client 157.22.72.155:52655] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||platinumhldg.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "platinumhldg.com"] [uri "/uploads/go.php"] [unique_id "avR2852nL8EDyncKije-LQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 18:46:43
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:46:38.667675 2026] [security2:error] [pid 26657:tid 26662] [client 157.22.72.155:14909] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:46:38.667675 2026] [security2:error] [pid 26657:tid 26662] [client 157.22.72.155:14909] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||gryphix.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "gryphix.com"] [uri "/choice-paradox-choosing-click-cta-button/"] [unique_id "avDDjsphWvVUVhZX2wry_QAAAEM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 01:45:27
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 20:45:18.293589 2026] [security2:error] [pid 31926:tid 31926] [client 157.22.72.155:32225] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 20:45:18.293589 2026] [security2:error] [pid 31926:tid 31926] [client 157.22.72.155:32225] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.kbalan.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.kbalan.com"] [uri "/books/wolf-appeal-box-set"] [unique_id "au_ULt17xjvnJxH5-rX_RAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 22:30:36
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 17:30:32.733373 2026] [security2:error] [pid 31765:tid 31765] [client 157.22.72.155:20679] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 17:30:32.733373 2026] [security2:error] [pid 31765:tid 31765] [client 157.22.72.155:20679] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.americanacademyofteachersofsinging.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.americanacademyofteachersofsinging.org"] [uri "/aats-awards/"] [unique_id "au-miLZQAcB3lPHtjkOulgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 15:11:55
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 10:11:49.522645 2026] [security2:error] [pid 24341:tid 24341] [client 157.22.72.155:28977] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 10:11:49.522645 2026] [security2:error] [pid 24341:tid 24341] [client 157.22.72.155:28977] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||alexgitlin.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "alexgitlin.com"] [uri "/drama.htm"] [unique_id "au8_terG9uq24VuzKUC6fQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-11 07:50:15
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 3 attempts were recorded from 157.22.72.155
2026-09-11T08:27:09+02:00 vpn Access-Reject 'user' station: 157.22.72.155 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' ...
show more
Unauthorized VPN login attempts: 3 attempts were recorded from 157.22.72.155
2026-09-11T08:27:09+02:00 vpn Access-Reject 'user' station: 157.22.72.155 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-11T08:28:47+02:00 vpn Access-Reject 'tech' station: 157.22.72.155 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-11T08:30:13+02:00 vpn Access-Reject 'root' station: 157.22.72.155 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-02 06:14:24
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 02 02:14:20.389192 2026] [security2:error] [pid 2820130:tid 2820130] [client 157.22.72.155:9653 ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 02 02:14:20.389192 2026] [security2:error] [pid 2820130:tid 2820130] [client 157.22.72.155:9653] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||321q.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "321q.com"] [uri "/wp-json/wp/v2/users"] [unique_id "am7gPFe29f3YPJx11DzROAAAABY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
magefix
2026-07-31 04:31:00
UTC ·
(3 months ago)
Fraudulent orders placed through WooCommerce store using stolen/fake customer and payment information.
Fraud Orders
🇨🇦
DRI
2026-07-31 00:17:31
UTC ·
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇨🇦
DRI
2026-07-27 10:43:03
UTC ·
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇺🇸
TPI-Abuse
2026-07-26 09:14:48
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 05:14:41.051125 2026] [security2:error] [pid 3743402:tid 3743402] [client 157.22.72.155:3441 ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.72.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 05:14:41.051125 2026] [security2:error] [pid 3743402:tid 3743402] [client 157.22.72.155:34411] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rogerandcarol.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rogerandcarol.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amXQAZ6lpURL1-X7PXzwhwAAAAI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
DRI
2026-07-22 21:49:32
UTC ·
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇬🇷
setupgr
2026-07-18 19:30:18
UTC ·
(3 months ago)
(XMLRPC) WP XMLRPC Attack 157.22.72.155 (GB/United Kingdom/England/London/-/[AS213954 -Reserved AS-]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 157.22.72.155 - - [18/Jul/2026:22:26:31 +0300] "POST /xmlrpc ...
show more
(XMLRPC) WP XMLRPC Attack 157.22.72.155 (GB/United Kingdom/England/London/-/[AS213954 -Reserved AS-]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 157.22.72.155 - - [18/Jul/2026:22:26:31 +0300] "POST /xmlrpc.php HTTP/1.1" 404 16 "-" "curl/7.88.1"
show less
Port Scan
🇫🇷
tecnicorioja
2026-05-16 22:00:33
UTC ·
(5 months ago)
wp-login attack [16/May/2026:22:56:31
Brute-Force
Web App Attack
