🇪🇸
librebit
2026-11-11 05:02:27
UTC ·
(8 hours ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-11-09 10:27:58
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 170.168.241.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 05:27:51.922227 2026] [security2:error] [pid 18544:tid 18544] [client 170.168.241.28:21435] ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.241.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 05:27:51.922227 2026] [security2:error] [pid 18544:tid 18544] [client 170.168.241.28:21435] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.natural-history-conservation.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.natural-history-conservation.com"] [uri "/publications.htm"] [unique_id "avGgJ_FM7SpCoMn8zZAetQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 22:48:47
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 170.168.241.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 17:48:43.314183 2026] [security2:error] [pid 8396:tid 8396] [client 170.168.241.28:56575] M ...
show more
(mod_security) mod_security (id:210730) triggered by 170.168.241.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 17:48:43.314183 2026] [security2:error] [pid 8396:tid 8396] [client 170.168.241.28:56575] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||persnicketyinc.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "persnicketyinc.com"] [uri "/wedding-show-at-linwood-estate/lesliegilbertphotography.com"] [unique_id "aufBy2-tiB296ZWc-sIXJgAAAAo"], referer: http://persnicketyinc.com/wedding-show-at-linwood-estate/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 19:09:39
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 170.168.241.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:09:34.186521 2026] [security2:error] [pid 29245:tid 29245] [client 170.168.241.28:14015] ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.241.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:09:34.186521 2026] [security2:error] [pid 29245:tid 29245] [client 170.168.241.28:14015] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||tulsatvmemories.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "tulsatvmemories.com"] [uri "/chewenro.html"] [unique_id "auJIbkJe_nSwfOgvKjoXLwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 00:19:25
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 170.168.241.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 20:19:18.985078 2026] [security2:error] [pid 15645:tid 15645] [client 170.168.241.28:54019] ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.241.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 20:19:18.985078 2026] [security2:error] [pid 15645:tid 15645] [client 170.168.241.28:54019] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.windisfun.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.windisfun.com"] [uri "/sailinginstructions04.html"] [unique_id "atv5hpYckuLgYye_LAZ27AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
bittiguru.fi
2026-09-20 03:59:47
UTC ·
(1 month ago)
170.168.241.28 - [20/Sep/2026:06:59:02 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" "4.66"
170.168.241.28 - [20/Sep/2026:06:59:47 +0300] "POST /xmlrpc.php HTTP/2.0 ...
show more
170.168.241.28 - [20/Sep/2026:06:59:02 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" "4.66"
170.168.241.28 - [20/Sep/2026:06:59:47 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" "4.66"
...
show less
Hacking
Brute-Force
Web App Attack
🇳🇱
i-turnradio.nl
2026-07-22 19:15:34
UTC ·
(3 months ago)
2026-07-22 @ 21:15:33 (CET) ~ Blocked for trying to access: /erker/wp/wp-login.php
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-26 01:41:52
UTC ·
(4 months ago)
[Fri Jun 26 11:41:52.317861 2026] [security2:error] [pid 604555] [client 170.168.241.28:18275] [client 170.168.241.28] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/RE ...
show more
[Fri Jun 26 11:41:52.317861 2026] [security2:error] [pid 604555] [client 170.168.241.28:18275] [client 170.168.241.28] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/xmlrpc.php"] [unique_id "aj3Y4NPINf6TxSzUDP3lQQAAAAY"]
...
show less
Web App Attack
🇩🇪
london2038.com
2026-06-12 04:07:27
UTC ·
(4 months ago)
Detected by WP fail2ban
2026-06-12T06:07:26.990073+02:00 wordpress: Authentication attempt from 170.168.241.28
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-13 20:31:15
UTC ·
(5 months ago)
(mod_security) mod_security (id:218580) triggered by 170.168.241.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 16:31:09.183626 2026] [security2:error] [pid 26947:tid 26947] [client 170.168.241.28:58841] ...
show more
(mod_security) mod_security (id:218580) triggered by 170.168.241.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 16:31:09.183626 2026] [security2:error] [pid 26947:tid 26947] [client 170.168.241.28:58841] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:\\\\/\\\\*[!+](?:[\\\\w\\\\s=_\\\\-()]+)?\\\\*\\\\/)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/22_SQL_SQLi.conf"] [line "76"] [id "218580"] [rev "1"] [msg "COMODO WAF: MySQL in-line comment detected.||www.genesis-castle.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "www.genesis-castle.com"] [uri "/gallery/index.php"] [unique_id "agTfjZ0dhsPueHf-gWyEkQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
kjaerulff
2026-05-03 23:26:41
UTC ·
(6 months ago)
Failed Wordpress login using wp-login.php
Web App Attack
🇲🇾
Rizzy
2026-05-03 00:21:13
UTC ·
(6 months ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇨🇭
backslash
2026-04-29 21:42:00
UTC ·
(6 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2026-04-07 19:29:55
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 170.168.241.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 07 15:29:51.473976 2026] [security2:error] [pid 1382659:tid 1382659] [client 170.168.241.28:38 ...
show more
(mod_security) mod_security (id:225170) triggered by 170.168.241.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 07 15:29:51.473976 2026] [security2:error] [pid 1382659:tid 1382659] [client 170.168.241.28:38439] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thenorwoods.name|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thenorwoods.name"] [uri "/wp-json/wp/v2/users"] [unique_id "adVbLw9Bp8t4xKLO6YBRygAAAAc"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
i-turnradio.nl
2026-02-02 02:17:05
UTC ·
(9 months ago)
2026-02-02 @ 03:17:05 (CET) ~ Blocked for trying to access: /erker/wp/wp-login.php
Web App Attack
