🇺🇸
TPI-Abuse
2026-03-24 16:55:22
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 178.20.28.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 178.20.28.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 24 12:47:45.058239 2026] [security2:error] [pid 5726:tid 5726] [client 178.20.28.195:27579] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||webjemm.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "webjemm.net"] [uri "/wp-json/wp/v2/users"] [unique_id "acLAMfuZZNvkGmswmce91AAAADQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-22 09:30:50
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 178.20.28.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 178.20.28.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 05:30:45.836283 2026] [security2:error] [pid 19357:tid 19357] [client 178.20.28.195:65495] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rogerg.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rogerg.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab-2xWinjs4C3RMJgv8bnQAAAAI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 23:54:09
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 178.20.28.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 178.20.28.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 19:54:02.117055 2026] [security2:error] [pid 18832:tid 18832] [client 178.20.28.195:18095] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gonzalez.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gonzalez.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab8vmnvopBoKu6PJ_b9VCAAAAAA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xmission.com
2026-03-02 15:04:54
(3 months ago)
178.20.28.195 - - [02/Mar/2026:08:04:54 -0700] "POST /wp-login.php HTTP/1.1" 200 2326 "https://dooce ...
show more
178.20.28.195 - - [02/Mar/2026:08:04:54 -0700] "POST /wp-login.php HTTP/1.1" 200 2326 "https://dooce.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
...
show less
Brute-Force
🇨🇭
backslash
2025-05-20 14:15:03
(1 year ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2025-03-10 13:00:07
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 178.20.28.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 178.20.28.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 10 09:00:04.860152 2025] [security2:error] [pid 28742:tid 28753] [client 178.20.28.195:61175] [client 178.20.28.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nicholsinvest.com"] [uri "/.env"] [unique_id "Z87iVODPT1ErB4QsxudohAAAAAI"], referer: https://tasamm.com/about/mmm241.html
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
lp
2025-02-05 07:22:06
(1 year ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.28.195
2025-02-05T08:11:50+01: ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.28.195
2025-02-05T08:11:50+01:00 vpn Access-Reject 'Abaser' station: 178.20.28.195 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇸🇪
OnTheEdge
2025-01-31 04:56:50
(1 year ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇿
lp
2025-01-28 17:50:03
(1 year ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.28.195
2025-01-28T17:34:34+01: ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.28.195
2025-01-28T17:34:34+01:00 vpn Access-Reject 'aswing' station: 178.20.28.195 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇵🇱
rafamiga
2024-09-13 22:08:00
(1 year ago)
178.20.28.195 [14/Sep/2024:00:08:11 +0200] "GET /admin HTTP/1.0" 404 242 "https://www.google.com" "M ...
show more
178.20.28.195 [14/Sep/2024:00:08:11 +0200] "GET /admin HTTP/1.0" 404 242 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" 27013
178.20.28.195 [14/Sep/2024:00:08:13 +0200] "GET /admin/ HTTP/1.0" 404 243 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" 365
178.20.28.195 [14/Sep/2024:00:08:15 +0200] "GET /admin HTTP/1.0" 404 242 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" 857
178.20.28.195 [14/Sep/2024:00:08:16 +0200] "GET /admin/ HTTP/1.0" 404 243 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" 70521
178.20.28.195 [14/Sep/2024:00:08:17 +0200] "GET /admin HTTP/1.0" 404 242 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0…
show less
Port Scan
Brute-Force