🇺🇸
TPI-Abuse
2026-11-10 14:56:39
UTC ·
(17 hours ago)
(mod_security) mod_security (id:210350) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:56:33.659528 2026] [security2:error] [pid 18091:tid 18091] [client 178.20.215.98:54269] M ...
show more
(mod_security) mod_security (id:210350) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:56:33.659528 2026] [security2:error] [pid 18091:tid 18091] [client 178.20.215.98:54269] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||guldunyayayinlari.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "guldunyayayinlari.com"] [uri "/2018/09/feryal-saygiligil-ile-bir-kadin-grevi-uzerine-soylesi-bu-kadinlar-vazgecmeyecek-bunu-anladik/"] [unique_id "avMwofR3EoVusXhtjIgL2AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 16:39:11
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 12:39:06.222788 2026] [security2:error] [pid 2050:tid 2050] [client 178.20.215.98:20987] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 12:39:06.222788 2026] [security2:error] [pid 2050:tid 2050] [client 178.20.215.98:20987] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.misscharlottemusic.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.misscharlottemusic.com"] [uri "/yourweeklylisten/music/a-tribute-to-charlie-hebdo-edith-piaf-sings-no-je-ne-regrette-rien-no-i-regret-nothing/"] [unique_id "auIlKuZhJ_U8dMpvEYNc1QAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 19:19:51
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 15:19:44.903726 2026] [security2:error] [pid 26134:tid 26134] [client 178.20.215.98:22015] M ...
show more
(mod_security) mod_security (id:210350) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 15:19:44.903726 2026] [security2:error] [pid 26134:tid 26134] [client 178.20.215.98:22015] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||tedmccachren.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "tedmccachren.com"] [uri "/Harrisburg-Mail-Post.html"] [unique_id "ate-0CnmbWoouAd5MxuE4gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
OnTheEdge
2026-09-13 18:42:06
UTC ·
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇸🇪
OnTheEdge
2026-09-13 18:42:06
UTC ·
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
www.winos.me
2026-09-03 20:20:13
UTC ·
(2 months ago)
Scanning for sensitive files/paths: /xmlrpc.php
Hacking
Web App Attack
🇬🇧
adnscom.net
2026-06-16 03:03:51
UTC ·
(4 months ago)
IPS trigger: Brute force WebApp/CMS scanning/attack
Brute-Force
Web App Attack
🇺🇸
nationaleventpros.com
2026-06-15 00:12:37
UTC ·
(4 months ago)
WordPress login attempt
Brute-Force
🇺🇸
TPI-Abuse
2026-06-07 21:51:02
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 17:50:55.691576 2026] [security2:error] [pid 23916:tid 23916] [client 178.20.215.98:58133] M ...
show more
(mod_security) mod_security (id:225170) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 17:50:55.691576 2026] [security2:error] [pid 23916:tid 23916] [client 178.20.215.98:58133] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||virlouise.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "virlouise.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiXnvz-3U2KrjgUa89cJ6gAAAA4"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ph
2026-06-07 16:40:00
UTC ·
(5 months ago)
Bad web bot attempting to run wp-login.php on non-WP site
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-04 23:44:21
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 19:44:17.026124 2026] [security2:error] [pid 21460:tid 21460] [client 178.20.215.98:60937] M ...
show more
(mod_security) mod_security (id:225170) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 19:44:17.026124 2026] [security2:error] [pid 21460:tid 21460] [client 178.20.215.98:60937] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||staben.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "staben.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiIN0ZP6UzaVPqWve4vUzAAAAAs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-30 18:31:57
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 30 14:31:54.507035 2026] [security2:error] [pid 25086:tid 25086] [client 178.20.215.98:30621] M ...
show more
(mod_security) mod_security (id:225170) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 30 14:31:54.507035 2026] [security2:error] [pid 25086:tid 25086] [client 178.20.215.98:30621] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nakedtyro.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nakedtyro.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahstGhmdJh_Ondv32egbrgAAAAI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 01:07:00
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 21:06:57.538189 2026] [security2:error] [pid 18739:tid 18739] [client 178.20.215.98:31529] M ...
show more
(mod_security) mod_security (id:225170) triggered by 178.20.215.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 21:06:57.538189 2026] [security2:error] [pid 18739:tid 18739] [client 178.20.215.98:31529] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rendermatrix.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rendermatrix.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agZxsXXNsCdnnn4KEK-grgAAAAs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
