🇺🇸
TPI-Abuse
2026-11-11 01:08:31
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:08:28.303948 2026] [security2:error] [pid 14752:tid 14752] [client 185.101.21.28:64319] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:08:28.303948 2026] [security2:error] [pid 14752:tid 14752] [client 185.101.21.28:64319] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.watonga.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.watonga.com"] [uri "/biblebios/lot/partnersuche-akademiker-hamburg/"] [unique_id "avPADFfJUHCrYtRxIPQmWQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 00:16:29
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:16:22.991372 2026] [security2:error] [pid 6387:tid 6387] [client 185.101.21.28:30869] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:16:22.991372 2026] [security2:error] [pid 6387:tid 6387] [client 185.101.21.28:30869] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.fgrotary.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fgrotary.org"] [uri "/speaker/tualatin-valley-creates/"] [unique_id "avJiVumSs7gTJFiwcyjwmgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 08:05:58
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 03:05:54.404516 2026] [security2:error] [pid 10197:tid 10197] [client 185.101.21.28:64955] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 03:05:54.404516 2026] [security2:error] [pid 10197:tid 10197] [client 185.101.21.28:64955] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||trasimeno.ws|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "trasimeno.ws"] [uri "/cucina_tegamaccio_it.html"] [unique_id "avF-4jZG_GW0LV-RFl8VnQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 00:53:16
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 19:53:11.751005 2026] [security2:error] [pid 18532:tid 18532] [client 185.101.21.28:9687] Mo ...
show more
(mod_security) mod_security (id:210350) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 19:53:11.751005 2026] [security2:error] [pid 18532:tid 18532] [client 185.101.21.28:9687] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||fruitinthedesert.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "fruitinthedesert.com"] [uri "/Fruits/the-faith-and-patriotism-of-john-wayne/"] [unique_id "auvTdw-toxGUgC_bq8FnYwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 00:58:36
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 19:58:33.512315 2026] [security2:error] [pid 15166:tid 15179] [client 185.101.21.28:10871] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 19:58:33.512315 2026] [security2:error] [pid 15166:tid 15179] [client 185.101.21.28:10871] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||econpage.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "econpage.com"] [uri "/301/handouts/IC_applications/sandi_effects.htm"] [unique_id "aufgOXiqvZN4rectl_mRCAAAAUs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 16:07:49
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 12:07:44.520875 2026] [security2:error] [pid 9297:tid 9297] [client 185.101.21.28:22727] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 12:07:44.520875 2026] [security2:error] [pid 9297:tid 9297] [client 185.101.21.28:22727] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.anneoday.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.anneoday.com"] [uri "/writing/LoveSonnet.htm"] [unique_id "auNvUO9iijbQL2gGDrDb4gAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-23 18:49:17
UTC ·
(3 weeks ago)
WordPress attack-tool calls | method: POST | path: /xmlrpc.php | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15 | 2026-10-23 18:49 UTC
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-23 03:36:39
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 23:36:34.667194 2026] [security2:error] [pid 2898:tid 2898] [client 185.101.21.28:58765] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 23:36:34.667194 2026] [security2:error] [pid 2898:tid 2898] [client 185.101.21.28:58765] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||allotrope.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "allotrope.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atrWQihOqYkwQSzxl2V59wAAAAs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 03:21:00
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:225170) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 23:20:56.636877 2026] [security2:error] [pid 12947:tid 12947] [client 185.101.21.28:40465] M ...
show more
(mod_security) mod_security (id:225170) triggered by 185.101.21.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 23:20:56.636877 2026] [security2:error] [pid 12947:tid 12947] [client 185.101.21.28:40465] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||abbysue.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "abbysue.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atBGmHU78soXiJtVWqjoWgAAAAg"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-08 09:02:41
UTC ·
(1 month ago)
WordPress login brute force | path: /xmlrpc.php | ua: Apache-HttpClient/4.5.13 (Java/17.0.18)
Brute-Force
Web App Attack
2026-10-04 01:00:33
UTC ·
(1 month ago)
Web application attack detected.
Web App Attack
🇬🇧
gigatech
2026-09-30 05:10:14
UTC ·
(1 month ago)
Webserver Probing
Web App Attack
🇺🇸
nationaleventpros.com
2026-09-30 03:01:42
UTC ·
(1 month ago)
WordPress login attempt
Brute-Force
🇨🇿
Countryman
2026-09-14 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-10 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
