🇺🇸
TPI-Abuse
2026-11-11 00:48:13
UTC ·
(12 hours ago)
(mod_security) mod_security (id:210350) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:48:08.666745 2026] [security2:error] [pid 17766:tid 17766] [client 157.22.74.121:37409] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:48:08.666745 2026] [security2:error] [pid 17766:tid 17766] [client 157.22.74.121:37409] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.louiemobilemixology.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.louiemobilemixology.com"] [uri "/index-4.html"] [unique_id "avO7SMkcacQ2j7w-Y6oktwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 17:14:33
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 12:14:28.234893 2026] [security2:error] [pid 24811:tid 24811] [client 157.22.74.121:9347] Mo ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 12:14:28.234893 2026] [security2:error] [pid 24811:tid 24811] [client 157.22.74.121:9347] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2015/03/03/northern-ireland-attracting-more-notice-in-uk-elections/"] [unique_id "autn9M98a_d9g4_iJu9Z9QAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 12:13:46
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 07:13:39.964720 2026] [security2:error] [pid 1254778:tid 1254803] [client 157.22.74.121:3795 ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 07:13:39.964720 2026] [security2:error] [pid 1254778:tid 1254803] [client 157.22.74.121:37957] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||baronlongford.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "baronlongford.com"] [uri "/List-of-Townlands-of-Longford-Annaly.html"] [unique_id "auh-c2L3tUILfrEhbAGS-AAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 19:37:09
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:37:05.131670 2026] [security2:error] [pid 22889:tid 22889] [client 157.22.74.121:57193] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:37:05.131670 2026] [security2:error] [pid 22889:tid 22889] [client 157.22.74.121:57193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.jerusalem-korczak-home.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.jerusalem-korczak-home.com"] [uri "/sar/sa2.html"] [unique_id "auJO4VlXvzJ8hovmGDOepAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 16:26:24
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 12:26:17.296964 2026] [security2:error] [pid 6794:tid 6794] [client 157.22.74.121:13701] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 12:26:17.296964 2026] [security2:error] [pid 6794:tid 6794] [client 157.22.74.121:13701] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||dogdimension.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "dogdimension.com"] [uri "/DiversitySite/purebreddogs21stcent.shtml"] [unique_id "auDQqa9APbBl6jHgUIhSsAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-10-25 03:34:22
UTC ·
(2 weeks ago)
Fail2Ban banned 157.22.74.121 for security violations in jail wp-armour. Log: 2026/10/25 03:34:21 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 157.22.74.121 | Target: wplogin" , client: 157.22.74.121, server: [REDACTED], request: ...
show more
Fail2Ban banned 157.22.74.121 for security violations in jail wp-armour. Log: 2026/10/25 03:34:21 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 157.22.74.121 | Target: wplogin" , client: 157.22.74.121, server: [REDACTED], request: "POST /wp-login.php?wp_lang=en_US HTTP/2.0", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php?wp_lang=en_US"
...
show less
Web Spam
🇨🇿
Countryman
2026-09-15 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-14 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇫🇷
mrcrassi
2026-08-25 12:35:56
UTC ·
(2 months ago)
Triggered Cloudflare WAF (firewallCustom) from FI.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0
This report was generated by:
https:// ...
show more
Triggered Cloudflare WAF (firewallCustom) from FI.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇷
MatStef132
2026-07-05 19:22:52
UTC ·
(4 months ago)
MatShield L7: blocked on mathost.eu (ua-quarantined)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-16 03:04:39
UTC ·
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 23:04:35.202319 2026] [security2:error] [pid 15881:tid 15881] [client 157.22.74.121:13269] M ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 23:04:35.202319 2026] [security2:error] [pid 15881:tid 15881] [client 157.22.74.121:13269] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bizzmail.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bizzmail.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ajC9QywkY1_5qz_aASJaDAAAAAo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 10:43:14
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 06:43:09.022155 2026] [security2:error] [pid 30387:tid 30387] [client 157.22.74.121:43175] M ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.74.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 06:43:09.022155 2026] [security2:error] [pid 30387:tid 30387] [client 157.22.74.121:43175] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||scorpio01.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "scorpio01.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahQnvfiX76BrayNl4OvDLgAAAAM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nationaleventpros.com
2026-05-20 04:10:32
UTC ·
(5 months ago)
WordPress login attempt
Brute-Force
🇩🇪
LRob
2026-05-15 00:30:09
UTC ·
(5 months ago)
WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail
Brute-Force
Web App Attack
🇩🇪
LRob
2026-05-14 10:30:04
UTC ·
(5 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
