🇺🇸
TPI-Abuse
2026-11-13 11:03:55
UTC ·
(19 hours ago)
(mod_security) mod_security (id:210350) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 06:03:49.318897 2026] [security2:error] [pid 13537:tid 13537] [client 172.83.252.185:61967] ...
show more
(mod_security) mod_security (id:210350) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 06:03:49.318897 2026] [security2:error] [pid 13537:tid 13537] [client 172.83.252.185:61967] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ofertasdetrabajosyempleos.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ofertasdetrabajosyempleos.com"] [uri "/espana/buscador-enfermera-algeciras.php"] [unique_id "avbulRhxELFlxrZskDb6rwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 00:11:10
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 19:11:04.053365 2026] [security2:error] [pid 17253:tid 17253] [client 172.83.252.185:25299] ...
show more
(mod_security) mod_security (id:225170) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 19:11:04.053365 2026] [security2:error] [pid 17253:tid 17253] [client 172.83.252.185:25299] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||web164.dnchosting.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "web164.dnchosting.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aup4GM-snyWd6jTa8sBQCQAAABA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 05:57:23
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 00:57:19.289950 2026] [security2:error] [pid 23056:tid 23056] [client 172.83.252.185:16831] ...
show more
(mod_security) mod_security (id:210350) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 00:57:19.289950 2026] [security2:error] [pid 23056:tid 23056] [client 172.83.252.185:16831] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.jerusalem-korczak-home.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.jerusalem-korczak-home.com"] [uri "/kk/r/kuch.htm"] [unique_id "aul3v070fdqPjpbXe1v8eQAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
UnixPrime
2026-11-01 14:02:26
UTC ·
(1 week ago)
172.83.252.185 - - [01/Nov/2026:15:02:24 +0100] "GET /wp-login.php HTTP/1.1" 404 181 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
172.83.252.185 - - [01/Nov/2026:15:0 ...
show more
172.83.252.185 - - [01/Nov/2026:15:02:24 +0100] "GET /wp-login.php HTTP/1.1" 404 181 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
172.83.252.185 - - [01/Nov/2026:15:02:25 +0100] "GET /wp-login.php HTTP/1.1" 404 181 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇧🇪
voormedia
2026-10-31 11:17:39
UTC ·
(1 week ago)
Accessed trap at '/wp-login.php'
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 12:16:44
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 08:16:40.480481 2026] [security2:error] [pid 27285:tid 27285] [client 172.83.252.185:18477] ...
show more
(mod_security) mod_security (id:210350) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 08:16:40.480481 2026] [security2:error] [pid 27285:tid 27285] [client 172.83.252.185:18477] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||enespiral.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "enespiral.net"] [uri "/etapa1/interiors/textos/proust.htm"] [unique_id "auSKqCgbXigBz2NIJW02WQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 05:32:06
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 01:32:01.589111 2026] [security2:error] [pid 31650:tid 31650] [client 172.83.252.185:57367] ...
show more
(mod_security) mod_security (id:210350) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 01:32:01.589111 2026] [security2:error] [pid 31650:tid 31650] [client 172.83.252.185:57367] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||christianebooks.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "christianebooks.com"] [uri "/robots.txt"] [unique_id "auQr0daWmqnIafHCz4WngwAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 02:03:36
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 22:03:31.201556 2026] [security2:error] [pid 16592:tid 16592] [client 172.83.252.185:54161] ...
show more
(mod_security) mod_security (id:210350) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 22:03:31.201556 2026] [security2:error] [pid 16592:tid 16592] [client 172.83.252.185:54161] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/tag/ferguson-mo/"] [unique_id "auP684pInGFnX_7xuHFyQQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 01:22:24
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 21:22:17.578960 2026] [security2:error] [pid 9018:tid 9018] [client 172.83.252.185:56413] M ...
show more
(mod_security) mod_security (id:210350) triggered by 172.83.252.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 21:22:17.578960 2026] [security2:error] [pid 9018:tid 9018] [client 172.83.252.185:56413] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.tpdtuberental.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.tpdtuberental.com"] [uri "/"] [unique_id "atwISYSjtRTf2NBfMBdldwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-10-03 00:30:35
UTC ·
(1 month ago)
Automated honeypot detection. blocked ip against a Next.js application. Paths: /user/login, /wp-login.php. Blocked at the edge.
Bad Web Bot
🇭🇰
sandra361
2026-09-27 02:46:18
UTC ·
(1 month ago)
Port scan detected: 12 attempts across 1 port (7443). | Evidence: REAPER_TARPIT: IN=eth0 SRC=172.83.252.185 LEN=40 TOS=0x14 PREC=0x00 TTL=115 ID=60118 DF PROTO=TCP SPT=34751 DPT=7443 WINDOW=42340 RES=0x00 ACK URGP=0
Port Scan
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇫🇷
Tilellit.PRO
2026-02-15 05:43:03
UTC ·
(8 months ago)
Fail2Ban banned 172.83.252.185 for security violations in jail wp-armour. Log: 2026/02/15 05:43:03 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 172.83.252.185 | Target: wplogin" , client: 172.83.252.185, server: [REDACTED], reque ...
show more
Fail2Ban banned 172.83.252.185 for security violations in jail wp-armour. Log: 2026/02/15 05:43:03 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 172.83.252.185 | Target: wplogin" , client: 172.83.252.185, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
