🇺🇸
TPI-Abuse
2026-11-06 10:39:02
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 166.1.131.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:38:55.183726 2026] [security2:error] [pid 9630:tid 9630] [client 166.1.131.135:21601] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 166.1.131.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:38:55.183726 2026] [security2:error] [pid 9630:tid 9630] [client 166.1.131.135:21601] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2015/08/09/bills-reaction-the-mitt-documentary/"] [unique_id "au2uP0jG7lN0f3WNFtcwsQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 22:34:03
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 166.1.131.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 18:33:51.497878 2026] [security2:error] [pid 26391:tid 26403] [client 166.1.131.135:15467] M ...
show more
(mod_security) mod_security (id:210350) triggered by 166.1.131.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 18:33:51.497878 2026] [security2:error] [pid 26391:tid 26403] [client 166.1.131.135:15467] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||howardhallis.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "howardhallis.com"] [uri "/doctorstrange/customs.html"] [unique_id "atvgz7TQBvECEVvb3PrAygAAAMk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 13:09:23
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 166.1.131.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:09:15.561802 2026] [security2:error] [pid 21898:tid 21898] [client 166.1.131.135:61729] M ...
show more
(mod_security) mod_security (id:210350) triggered by 166.1.131.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:09:15.561802 2026] [security2:error] [pid 21898:tid 21898] [client 166.1.131.135:61729] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||unitymaine.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "unitymaine.org"] [uri "/gov/ordinances/landuse/doc.html"] [unique_id "atDQe6_ldvyaFMYnOUy4IgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
NxtGenIT
2026-09-10 13:57:25
UTC ·
(1 month ago)
CiscoASA Honeypot hit, Payload: "GET /+CSCOE+/logon.html HTTP/1.1" 302 -,
Brute-Force
🇩🇪
NxtGenIT
2026-09-10 11:53:32
UTC ·
(1 month ago)
CiscoASA Honeypot hit, Payload: "GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1" 200 -,
Brute-Force
🇨🇭
4server
2026-08-10 01:41:56
UTC ·
(2 months ago)
[MonAug1003:41:50.9438992026][security2:error][pid1698278:tid1698571][client166.1.131.135:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\" ...
show more
[MonAug1003:41:50.9438992026][security2:error][pid1698278:tid1698571][client166.1.131.135:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"edomustech.ch\"][uri\"/xmlrpc.php\"][unique_id\"anksXv3xSVGs14F_ZP5jGgAAAQ4\"]
show less
Hacking
Web App Attack
🇩🇪
C C
2026-08-06 00:45:32
UTC ·
(3 months ago)
Distributed scraping attack: 3436 req from 3224 rotating proxy IPs, waves of up to 156 req in 138s on a single URL | this IP: 1 req, 1 blocked
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-07-17 01:59:05
UTC ·
(3 months ago)
Web password guessing
Brute-Force
🇫🇮
JimArchon72
2026-07-10 23:10:02
UTC ·
(3 months ago)
2026/07/10 23:09:11 "GET /wp-login.php HTTP/1.1"
Web App Attack
🇺🇸
kosada.com
2026-07-02 21:26:55
UTC ·
(4 months ago)
Web password guessing
Brute-Force
🇫🇷
Tilellit.PRO
2026-06-28 07:38:36
UTC ·
(4 months ago)
Fail2Ban banned 166.1.131.135 for security violations in jail wp-armour. Log: 2026/06/28 07:38:36 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 166.1.131.135 | Target: wplogin" , client: 166.1.131.135, server: [REDACTED], request: ...
show more
Fail2Ban banned 166.1.131.135 for security violations in jail wp-armour. Log: 2026/06/28 07:38:36 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 166.1.131.135 | Target: wplogin" , client: 166.1.131.135, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇫🇷
Tilellit.PRO
2026-06-25 18:05:18
UTC ·
(4 months ago)
Fail2Ban banned 166.1.131.135 for security violations in jail wp-armour. Log: 2026/06/25 18:05:17 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 166.1.131.135 | Target: wplogin" , client: 166.1.131.135, server: [REDACTED], request: ...
show more
Fail2Ban banned 166.1.131.135 for security violations in jail wp-armour. Log: 2026/06/25 18:05:17 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 166.1.131.135 | Target: wplogin" , client: 166.1.131.135, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇨🇿
ptlab
2026-06-25 10:51:19
UTC ·
(4 months ago)
Detected wp_login attack from WP-host.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-19 15:02:59
UTC ·
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 166.1.131.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 11:02:55.175027 2026] [security2:error] [pid 19921:tid 19921] [client 166.1.131.135:44215] M ...
show more
(mod_security) mod_security (id:225170) triggered by 166.1.131.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 11:02:55.175027 2026] [security2:error] [pid 19921:tid 19921] [client 166.1.131.135:44215] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||flugstad.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "flugstad.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ajVaHxMkpJ4w8s2tSkG0ZQAAACU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-06-09 22:56:50
UTC ·
(4 months ago)
Web password guessing
Brute-Force
