🇺🇸
TPI-Abuse
2026-11-12 11:37:24
UTC ·
(21 hours ago)
(mod_security) mod_security (id:210350) triggered by 158.173.223.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 06:37:16.901043 2026] [security2:error] [pid 4849:tid 4849] [client 158.173.223.105:22951] ...
show more
(mod_security) mod_security (id:210350) triggered by 158.173.223.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 06:37:16.901043 2026] [security2:error] [pid 4849:tid 4849] [client 158.173.223.105:22951] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||zost.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "zost.net"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "avWk7D7B1v14Hw0w0hOkuQAAABo"], referer: www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-12 11:11:25
UTC ·
(21 hours ago)
$f2bV_matches
Brute-Force
🇯🇵
S.O.B.A. Dev.
2026-11-12 10:50:53
UTC ·
(22 hours ago)
Web vulnerability scanning
Brute-Force
Web Spam
Web App Attack
🇺🇸
agenciahypelab.com.br
2026-11-12 10:04:48
UTC ·
(22 hours ago)
WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-11-12 09:49:02
UTC ·
(23 hours ago)
(mod_security) mod_security (id:210350) triggered by 158.173.223.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 04:48:55.925890 2026] [security2:error] [pid 15116:tid 15116] [client 158.173.223.105:3821 ...
show more
(mod_security) mod_security (id:210350) triggered by 158.173.223.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 04:48:55.925890 2026] [security2:error] [pid 15116:tid 15116] [client 158.173.223.105:38211] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jmichaelpope.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jmichaelpope.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "avWLh5HM0mO8wxffUlcemAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Epimetheus
2026-11-12 09:46:07
UTC ·
(23 hours ago)
Unauthorized access attempts:
[GET] /wp-content/themes/seotheme/db.php
[POST] /ALFA_DATA/alfacgiapi/perl.alfa
UA: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mo ...
show more
Unauthorized access attempts:
[GET] /wp-content/themes/seotheme/db.php
[POST] /ALFA_DATA/alfacgiapi/perl.alfa
UA: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
show less
Web App Attack
🇦🇺
clapper
2026-11-12 09:31:13
UTC ·
(23 hours ago)
(mod_security) mod_security (id:980001) triggered by 158.173.223.105 (JM/Jamaica/-): 5 in the last 3600 secs; ID: Clar
Brute-Force
Bad Web Bot
🇺🇸
francelink.fr
2026-11-12 08:46:26
UTC ·
(1 day ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-12T08:42:30.000Z.
Web App Attack
🇫🇷
dynamix
2026-11-12 08:22:34
UTC ·
(1 day ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 08:05:42
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 158.173.223.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 03:05:39.118496 2026] [security2:error] [pid 32381:tid 32381] [client 158.173.223.105:5160 ...
show more
(mod_security) mod_security (id:210350) triggered by 158.173.223.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 03:05:39.118496 2026] [security2:error] [pid 32381:tid 32381] [client 158.173.223.105:51601] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.josephshv.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.josephshv.com"] [uri "/wp-content/plugins/apikey/apikey.php"] [unique_id "avVzU2fdW5nj2At8I0mqewAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 07:49:32
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 158.173.223.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 02:49:26.616337 2026] [security2:error] [pid 17287:tid 17287] [client 158.173.223.105:3453 ...
show more
(mod_security) mod_security (id:210350) triggered by 158.173.223.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 02:49:26.616337 2026] [security2:error] [pid 17287:tid 17287] [client 158.173.223.105:34531] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cubbylure.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cubbylure.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "avVvhu4LtjkJ3n1KX_UXgQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 07:11:29
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 158.173.223.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 02:11:24.847702 2026] [security2:error] [pid 25433:tid 25534] [client 158.173.223.105:6266 ...
show more
(mod_security) mod_security (id:210350) triggered by 158.173.223.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 02:11:24.847702 2026] [security2:error] [pid 25433:tid 25534] [client 158.173.223.105:62665] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rawhabitat.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rawhabitat.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "avVmnEHnE365bWFid2OQXgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
pm33
2026-11-12 06:17:24
UTC ·
(1 day ago)
Excessive crawling HTTP 404
Web App Attack
🇬🇧
gigatech
2026-11-12 06:10:03
UTC ·
(1 day ago)
Webserver Probing
Web App Attack
🇧🇪
cmbplf
2026-11-12 05:26:07
UTC ·
(1 day ago)
236 requests with url.path *.alfa
154 requests with url.path */wp-plain.php
Brute-Force
Bad Web Bot
