🇺🇸
TPI-Abuse
2026-11-15 21:28:09
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 16:28:06.031049 2026] [security2:error] [pid 30289:tid 30289] [client 157.22.73.27:60851] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 16:28:06.031049 2026] [security2:error] [pid 30289:tid 30289] [client 157.22.73.27:60851] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ictsl.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ictsl.net"] [uri "/productos/aparatos/agitadormagneticoanalogicoarexccvelp.html"] [unique_id "avoj5gNj6Buk-k2t3HcIAQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 16:23:12
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 11:23:07.599414 2026] [security2:error] [pid 10535:tid 10535] [client 157.22.73.27:14109] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 11:23:07.599414 2026] [security2:error] [pid 10535:tid 10535] [client 157.22.73.27:14109] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||modmove.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "modmove.com"] [uri "/reviews/the-card-counter-movie-review/"] [unique_id "avc5a0Kg8-B_5P1KXQ9TGgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-11-04 16:59:41
UTC ·
(1 week ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 06:33:46
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 01:33:43.994861 2026] [security2:error] [pid 5567:tid 5567] [client 157.22.73.27:59491] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 01:33:43.994861 2026] [security2:error] [pid 5567:tid 5567] [client 157.22.73.27:59491] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.pleaseaddbacon.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.pleaseaddbacon.com"] [uri "/2012/08/fried-tofu-with-black-bean-sauce-sweet-savory-recipe/"] [unique_id "aumAR12OFDfVSgrI51mMFAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 02:39:35
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 21:39:30.257078 2026] [security2:error] [pid 29644:tid 29644] [client 157.22.73.27:16591] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 21:39:30.257078 2026] [security2:error] [pid 29644:tid 29644] [client 157.22.73.27:16591] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2010/05/17/a-rwandan-genocide-legacy-continued/"] [unique_id "auf34vP-EpfAhC9l0MNGPgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-02 01:26:19
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇩🇪
LRob
2026-10-31 01:38:44
UTC ·
(2 weeks ago)
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36/Nutch-1.23-SNAPS | 2026-10-31 01:38 UTC
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-28 18:56:57
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:56:51.787805 2026] [security2:error] [pid 23222:tid 23222] [client 157.22.73.27:38279] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:56:51.787805 2026] [security2:error] [pid 23222:tid 23222] [client 157.22.73.27:38279] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.seizetheseason.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.seizetheseason.com"] [uri "/genealogy/ajpfam.htm"] [unique_id "auJFc78EXXU99QuwsdfoLwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-28 00:55:33
UTC ·
(2 weeks ago)
Not following 301 redirects — wasted requests | method: GET | path: /robots.txt | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36/Nutch-1.23-SNAPS
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-24 18:16:13
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 14:16:07.473323 2026] [security2:error] [pid 18817:tid 18817] [client 157.22.73.27:45683] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 14:16:07.473323 2026] [security2:error] [pid 18817:tid 18817] [client 157.22.73.27:45683] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||matt-bechtel.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "matt-bechtel.com"] [uri "/writing/congratulations-its-a-blog/"] [unique_id "atz15ygzzXKvvwmRYASMqgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
librebit
2026-10-22 00:47:56
UTC ·
(3 weeks ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-10-21 12:40:17
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 08:40:13.829151 2026] [security2:error] [pid 20627:tid 20627] [client 157.22.73.27:19771] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.73.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 08:40:13.829151 2026] [security2:error] [pid 20627:tid 20627] [client 157.22.73.27:19771] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||socialstudiesforkids.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "socialstudiesforkids.com"] [uri "/articles/worldhistory/giza.htm"] [unique_id "atiyrQJyAbGzG3b7y9YopwAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-09-17 23:01:40
UTC ·
(1 month ago)
[FriSep1801:01:37.5600842026][security2:error][pid2796709:tid2796779][client157.22.73.27:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\|wget\|python\|nikto\|sqlmap\|acunetix\|fimap\|dirbuster\|cmsmap\)\"atREQUEST_HEADERS ...
show more
[FriSep1801:01:37.5600842026][security2:error][pid2796709:tid2796779][client157.22.73.27:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\|wget\|python\|nikto\|sqlmap\|acunetix\|fimap\|dirbuster\|cmsmap\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"217\"][id\"990210\"][msg\"Suspicioususer-agentblocked\"][hostname\"orabonastudio.it\"][uri\"/\"][unique_id\"aqxxUb76vSwYwhprSKfGyQAAAFA\"]
show less
Port Scan
Brute-Force
Web App Attack
🇫🇮
inlink.ltd
2026-05-20 09:23:11
UTC ·
(5 months ago)
Known malicious PHP file or CMS probe
Web App Attack
2026-05-19 00:03:53
UTC ·
(5 months ago)
Banned by Fail2Ban on server
Web App Attack
