2026-08-14 04:31:56
UTC ·
(3 months ago)
Failed login attempt detected by Fail2Ban in plesk-postfix jail
Brute-Force
🇺🇸
TPI-Abuse
2026-08-10 12:11:40
UTC ·
(3 months ago)
(mod_security) mod_security (id:217200) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 08:11:34.443754 2026] [security2:error] [pid 2978194:tid 2978194] [client 178.128.59.180:47 ...
show more
(mod_security) mod_security (id:217200) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 08:11:34.443754 2026] [security2:error] [pid 2978194:tid 2978194] [client 178.128.59.180:47838] ModSecurity: Access denied with code 403 (phase 1). Match of "endsWith /wp-cron.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "103"] [id "217200"] [rev "2"] [msg "COMODO WAF: HTTP/1.1 POST request missing Content-Length Header||oruguitas.org|F|2"] [data "/contact.html"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "oruguitas.org"] [uri "/contact.html"] [unique_id "anm_9iDcHU19KFBvHg07wwAAABI"], referer: https://oruguitas.org/contact.html
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nowyouknow
2026-08-10 05:10:36
UTC ·
(3 months ago)
(From [email protected] ) Hi there,
I'm Victoria with Vetted VAs.
I’m reaching out because we offer Virtual Assistants powered by our custom-built AI tools. We literally can take over your entire marketing, administrative tasks, graphic des ...
show more
(From [email protected] ) Hi there,
I'm Victoria with Vetted VAs.
I’m reaching out because we offer Virtual Assistants powered by our custom-built AI tools. We literally can take over your entire marketing, administrative tasks, graphic design, video animations, accounting, and even all your prospecting with our system.
Are you looking for any help?
Reply YES to schedule a Zoom meeting or STOP to unsubscribe.
show less
Phishing
Web Spam
🇺🇸
TPI-Abuse
2026-08-07 21:45:46
UTC ·
(3 months ago)
(mod_security) mod_security (id:217200) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 17:45:39.998428 2026] [security2:error] [pid 3830945:tid 3830969] [client 178.128.59.180:45 ...
show more
(mod_security) mod_security (id:217200) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 17:45:39.998428 2026] [security2:error] [pid 3830945:tid 3830969] [client 178.128.59.180:45152] ModSecurity: Access denied with code 403 (phase 1). Match of "endsWith /wp-cron.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "103"] [id "217200"] [rev "2"] [msg "COMODO WAF: HTTP/1.1 POST request missing Content-Length Header||www.pflagabq.org|F|2"] [data "/php/email.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.pflagabq.org"] [uri "/php/email.php"] [unique_id "anZSAz-c0-TJ0VlOut5HbwAAAAU"], referer: https://www.pflagabq.org/php/email_contact_join.html
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 16:10:16
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 12:10:09.796188 2026] [security2:error] [pid 511674:tid 511674] [client 178.128.59.180:4526 ...
show more
(mod_security) mod_security (id:210350) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 12:10:09.796188 2026] [security2:error] [pid 511674:tid 511674] [client 178.128.59.180:45264] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.capitalswisscorp.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.capitalswisscorp.com"] [uri "/"] [unique_id "anYDYS6vwyg3z42XtEIVuwAAACw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-08-03 22:56:25
UTC ·
(3 months ago)
wp-comments-post.php request blocked, no referer. Pattern match "wp-comments-post.php" at REQUEST_URI. (88520-196)
Hacking
🇺🇸
TPI-Abuse
2026-08-01 17:24:29
UTC ·
(3 months ago)
(mod_security) mod_security (id:217200) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 13:24:22.330791 2026] [security2:error] [pid 1915095:tid 1915095] [client 178.128.59.180:48 ...
show more
(mod_security) mod_security (id:217200) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 13:24:22.330791 2026] [security2:error] [pid 1915095:tid 1915095] [client 178.128.59.180:48762] ModSecurity: Access denied with code 403 (phase 1). Match of "endsWith /wp-cron.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "103"] [id "217200"] [rev "2"] [msg "COMODO WAF: HTTP/1.1 POST request missing Content-Length Header||www.texasfurnitureinc.com|F|2"] [data "/sendmail.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.texasfurnitureinc.com"] [uri "/sendmail.php"] [unique_id "am4rxrHN5fdHyvYs4GZIYAAAAAg"], referer: https://www.texasfurnitureinc.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nowyouknow
2026-07-28 16:51:01
UTC ·
(3 months ago)
(From [email protected] ) Hi there,
I'm Sophia with Top Talent VAs.
I’m reaching out because we offer MAVIS (My Advanced Virtual Intelligent System), that easily replaces a 20-man team. We overtake and handle all of your marketing, adminis ...
show more
(From [email protected] ) Hi there,
I'm Sophia with Top Talent VAs.
I’m reaching out because we offer MAVIS (My Advanced Virtual Intelligent System), that easily replaces a 20-man team. We overtake and handle all of your marketing, administrative tasks, graphic design, video animations, accounting, and even all your prospecting with our system.
This isn't a software you have to learn, and all you have to do is delegate to our Real Human MAVIS Specialist to get everything done!
Reply YES to schedule a Zoom meeting or STOP to unsubscribe.
show less
Phishing
Web Spam
🇺🇸
nowyouknow
2026-07-27 07:47:56
UTC ·
(3 months ago)
(From [email protected] ) Hi there,
I'm Amanda with Trusted Virtual Team.
I’m reaching out because we offer MAVIS (My Advanced Virtual Intelligent System), that easily replaces a 20-man team. We overtake and handle all of your market ...
show more
(From [email protected] ) Hi there,
I'm Amanda with Trusted Virtual Team.
I’m reaching out because we offer MAVIS (My Advanced Virtual Intelligent System), that easily replaces a 20-man team. We overtake and handle all of your marketing, administrative tasks, graphic design, video animations, accounting, and even all your prospecting with our system.
This isn't a software you have to learn, and all you have to do is delegate to our Real Human MAVIS Specialist to get everything done!
Reply YES to schedule a Zoom meeting or STOP to unsubscribe.
show less
Phishing
Web Spam
🇺🇸
TPI-Abuse
2026-07-20 11:56:42
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 07:56:37.248583 2026] [security2:error] [pid 28258:tid 28258] [client 178.128.59.180:57886] ...
show more
(mod_security) mod_security (id:210350) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 07:56:37.248583 2026] [security2:error] [pid 28258:tid 28258] [client 178.128.59.180:57886] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rkstewart.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rkstewart.com"] [uri "/contact-us.html"] [unique_id "al4M9YhZKHYP92jYv-DpoAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Silly Development
2026-07-14 10:18:06
UTC ·
(4 months ago)
Malicious activity detected from 14061 DigitalOcean, LLC towards host sillydev.co.uk (GET HTTP/2) @ 2026-07-14T10:18:06Z (114 occurrences)
DDoS Attack
Exploited Host
🇺🇸
TPI-Abuse
2026-07-13 15:15:33
UTC ·
(4 months ago)
(mod_security) mod_security (id:210350) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 11:15:28.461620 2026] [security2:error] [pid 1850013:tid 1850013] [client 178.128.59.180:38 ...
show more
(mod_security) mod_security (id:210350) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 11:15:28.461620 2026] [security2:error] [pid 1850013:tid 1850013] [client 178.128.59.180:38396] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||allisonstiles.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "allisonstiles.org"] [uri "/gwnet/uservalidationbyemail/emailsent"] [unique_id "alUBEDgm027GMJTnUJ8MHAAAAAo"], referer: http://allisonstiles.org/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
1gz
2026-07-13 06:46:20
UTC ·
(4 months ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/zbardhja-e-skemave-te-vjedhjeve-ceshtje-kohe-bardhi-spak-ka-ne-dore-nje-mal-me-dokumente-qe-provojne-korrupsionin-e-ballukut-mjaft ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/zbardhja-e-skemave-te-vjedhjeve-ceshtje-kohe-bardhi-spak-ka-ne-dore-nje-mal-me-dokumente-qe-provojne-korrupsionin-e-ballukut-mjafton-pak-vullnet/771565/
UA: manager(+internet-surf)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇨🇦
1gz
2026-07-12 04:14:23
UTC ·
(4 months ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/aksident-i-rende-ne-aksin-thumane-kashar-perplaset-per-vdekje-kembesori-emri/772191/
UA: manager(+internet-surf)
This report was ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/aksident-i-rende-ne-aksin-thumane-kashar-perplaset-per-vdekje-kembesori-emri/772191/
UA: manager(+internet-surf)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-08 22:55:37
UTC ·
(4 months ago)
(mod_security) mod_security (id:210350) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 18:55:29.905824 2026] [security2:error] [pid 20066:tid 20066] [client 178.128.59.180:52796] ...
show more
(mod_security) mod_security (id:210350) triggered by 178.128.59.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 18:55:29.905824 2026] [security2:error] [pid 20066:tid 20066] [client 178.128.59.180:52796] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.howardherrell.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.howardherrell.com"] [uri "/"] [unique_id "ak7VYQlPcc6hEWUEHPmiTAAAAA4"], referer: https://google.com
show less
Brute-Force
Bad Web Bot
Web App Attack