🇺🇸
TPI-Abuse
2026-10-26 17:41:03
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 185.102.112.76 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 185.102.112.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 13:40:58.694433 2026] [security2:error] [pid 17147:tid 17200] [client 185.102.112.76:21431] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||dubarch.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "dubarch.com"] [uri "/vacancies.xml"] [unique_id "at-Qql_YN2wnvvoLnKAASwAAAEk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
pamircil
2025-10-26 07:11:07
(1 year ago)
🍯 WinnieThePooh Honeypot : GET request to '/wp-content/themes/twentyseventeen' on (http/80)💀
Hacking
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-10-25 14:45:55
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 185.102.112.76 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 185.102.112.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 25 10:45:50.801501 2025] [security2:error] [pid 23249:tid 23249] [client 185.102.112.76:30019] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||darrenj.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "darrenj.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aPzinqbrvGCYE_nVzf05ZgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-24 16:15:42
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 185.102.112.76 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 185.102.112.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 24 12:15:36.712501 2025] [security2:error] [pid 6058:tid 6101] [client 185.102.112.76:52849] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||sallykimmel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sallykimmel.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aPumKJ_JIiwrypwC2wkFtwAAAYo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-20 05:35:53
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 185.102.112.76 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 185.102.112.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 20 01:35:46.722449 2025] [security2:error] [pid 8384:tid 8384] [client 185.102.112.76:32655] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||schlegelcreative.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "schlegelcreative.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aPXKMrBxIw_Cl4HaeqK0WwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ManagedStack
2025-10-19 11:23:19
(1 year ago)
Wordpress Attack
Web App Attack
🇨🇿
lp
2025-05-13 16:49:54
(1 year ago)
Unauthorized VPN login attempts: 2 attempts were recorded from 185.102.112.76
2025-05-13T17:54:49+02 ...
show more
Unauthorized VPN login attempts: 2 attempts were recorded from 185.102.112.76
2025-05-13T17:54:49+02:00 vpn Access-Reject 'mohamed' station: 185.102.112.76 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2025-05-13T18:19:37+02:00 vpn Access-Reject 'berkeley' station: 185.102.112.76 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
2025-04-19 15:02:42
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-04-18 06:46:40
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-04-17 10:00:00
(1 year ago)
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried us ...
show more
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user”
show less
Hacking
Brute-Force
Web App Attack
2025-04-17 10:00:00
(1 year ago)
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried us ...
show more
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user “
show less
Hacking
Brute-Force
Web App Attack
2025-04-10 02:04:11
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
www.winos.me
2025-04-07 16:07:38
(1 year ago)
xmlrpc does not allow access
Web App Attack
2025-04-07 14:22:28
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-03-13 05:48:09
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH