178.20.28.155

(mod_security) mod_security (id:210350) triggered by 178.20.28.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 09:27:12.980001 2026] [security2:error] [pid 17568:tid 17587] [client 178.20.28.155:57141] M ... show more (mod_security) mod_security (id:210350) triggered by 178.20.28.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 09:27:12.980001 2026] [security2:error] [pid 17568:tid 17587] [client 178.20.28.155:57141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||fiefblondel.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "fiefblondel.com"] [uri "/Advowson.html"] [unique_id "avR7QFhFr-nMgmkT4zovDAAAAFA"] show less

Brute force

(mod_security) mod_security (id:210350) triggered by 178.20.28.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 20:12:58.180348 2026] [security2:error] [pid 22102:tid 22102] [client 178.20.28.155:17383] M ... show more (mod_security) mod_security (id:210350) triggered by 178.20.28.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 20:12:58.180348 2026] [security2:error] [pid 22102:tid 22102] [client 178.20.28.155:17383] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||vitality-web.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "vitality-web.com"] [uri "/backstore/Fjords-London-Swing-Recliner.htm"] [unique_id "au0pmg5an6VBObUjPhtqFgAAABQ"] show less

(mod_security) mod_security (id:210350) triggered by 178.20.28.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:15:24.236306 2026] [security2:error] [pid 26581:tid 26581] [client 178.20.28.155:58457] M ... show more (mod_security) mod_security (id:210350) triggered by 178.20.28.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:15:24.236306 2026] [security2:error] [pid 26581:tid 26581] [client 178.20.28.155:58457] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.creartest.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.creartest.com"] [uri "/hacertests-217552-Unit_10_Lesson_B.php"] [unique_id "auJJzBZ6lFHSIXxsS3hkzgAAABo"] show less

(mod_security) mod_security (id:210350) triggered by 178.20.28.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:23:23.210924 2026] [security2:error] [pid 12995:tid 12995] [client 178.20.28.155:33169] M ... show more (mod_security) mod_security (id:210350) triggered by 178.20.28.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:23:23.210924 2026] [security2:error] [pid 12995:tid 12995] [client 178.20.28.155:33169] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||johnhansonmemorial.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "johnhansonmemorial.org"] [uri "/The_John_Hanson_National_Memorial/Home.html"] [unique_id "auI9m451Ap6TRhTRJosB6wAAABk"] show less

(mod_security) mod_security (id:210350) triggered by 178.20.28.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:47:10.321077 2026] [security2:error] [pid 6723:tid 6723] [client 178.20.28.155:29507] Mod ... show more (mod_security) mod_security (id:210350) triggered by 178.20.28.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:47:10.321077 2026] [security2:error] [pid 6723:tid 6723] [client 178.20.28.155:29507] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cain2012.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cain2012.org"] [uri "/CAIN2012/Bio.html"] [unique_id "atDZXrQZ2hdyZgS4eILJogAAACE"] show less

block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8

Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.28.155 2026-10-01T16:48:57+02:00 vpn Access-Reject 'user' station: 178.20.28.155 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'

repeated unauthorized VPN login attempt, user sweep

repeated unauthorized VPN login attempt, user sweep

[RoutePulse | 2026-09-09T00:50:42Z | RTBH-INJECTED] ATTACK CLASS: vpn_bruteforce SOURCE: 178.20.28.155 EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed attack (3 attempts/15min) — shun on the VPN g ... show more [RoutePulse | 2026-09-09T00:50:42Z | RTBH-INJECTED] ATTACK CLASS: vpn_bruteforce SOURCE: 178.20.28.155 EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed attack (3 attempts/15min) — shun on the VPN gateway DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring ACTION: BGP null route injected at RoutePulse network edge show less

Detected WordPress attack from different servers

Scanning for sensitive files/paths: /xmlrpc.php

[25/Aug/2026:02:04:28 +0300] -- 178.20.28.155 Ban reason: User-Agent curl/

(mod_security) mod_security (id:225170) triggered by 178.20.28.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 15:58:18.304740 2026] [security2:error] [pid 11068:tid 11068] [client 178.20.28.155:39697] M ... show more (mod_security) mod_security (id:225170) triggered by 178.20.28.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 15:58:18.304740 2026] [security2:error] [pid 11068:tid 11068] [client 178.20.28.155:39697] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rooksfamily.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rooksfamily.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahSp2qJRCRgRplyq6JUWdQAAAAs"], referer: https://www.google.com show less