178.20.31.254

(mod_security) mod_security (id:210350) triggered by 178.20.31.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 03:02:41.276352 2026] [security2:error] [pid 16894:tid 16894] [client 178.20.31.254:10627] M ... show more (mod_security) mod_security (id:210350) triggered by 178.20.31.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 03:02:41.276352 2026] [security2:error] [pid 16894:tid 16894] [client 178.20.31.254:10627] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||n3fjp.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "n3fjp.com"] [uri "/donations.html"] [unique_id "avbEITT1_71KK2SRYN_Y7QAAAAA"] show less

(mod_security) mod_security (id:210350) triggered by 178.20.31.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 03:58:44.740777 2026] [security2:error] [pid 15516:tid 15516] [client 178.20.31.254:63023] M ... show more (mod_security) mod_security (id:210350) triggered by 178.20.31.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 03:58:44.740777 2026] [security2:error] [pid 15516:tid 15516] [client 178.20.31.254:63023] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/tag/france/page/3/"] [unique_id "aurzxDbjbhtmyBKN_eXHUgAAAAw"] show less

Web App Attack

[ThuSep1002:27:18.5182802026][security2:error][pid152769:tid153067][client178.20.31.254:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"614\"][id\"96 ... show more [ThuSep1002:27:18.5182802026][security2:error][pid152769:tid153067][client178.20.31.254:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"614\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"leonitraslochi.ch\"][uri\"/xmlrpc.php\"][unique_id\"aqH5ZpN0lSkL_pjfNDuU6AAAAZU\"] show less

Triggered Cloudflare WAF (firewallCustom) from FR. Action taken: BLOCK Protocol: HTTP/2 (POST method) Endpoint: /wp-login.php UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15 T ... show more Triggered Cloudflare WAF (firewallCustom) from FR. Action taken: BLOCK Protocol: HTTP/2 (POST method) Endpoint: /wp-login.php UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less

Brute force

Jarvis auto-ban: CF honeypot path /wp-login.php (1× on saec.me)

Detected WordPress attack from 4 different servers

[Sat Mar 07 23:31:04.705143 2026] [php7:error] [pid 1479217:tid 1479217] [client 178.20.31.254:36843] script '/var/www/html/blog.solution.it/wp-login.php' not found or unable to stat

Failed Wordpress login using wp-login.php

Incoming Layer 7 Flood Detected

Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.31.254 2025-02-07T14:31:14+01:00 vpn Access-Reject 'bullwhipping' station: 178.20.31.254 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<re ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.31.254 2025-02-07T14:31:14+01:00 vpn Access-Reject 'bullwhipping' station: 178.20.31.254 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less

Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.31.254 2025-02-06T06:25:22+01:00 vpn Access-Reject 'applaud' station: 178.20.31.254 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacte ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.31.254 2025-02-06T06:25:22+01:00 vpn Access-Reject 'applaud' station: 178.20.31.254 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less

Password spraying. Multiple unauthorized login attempts

Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.31.254 2025-01-27T19:38:07+01:00 vpn Access-Reject 'rain' station: 178.20.31.254 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'