🇺🇸
TPI-Abuse
2026-11-10 13:05:33
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:05:27.265245 2026] [security2:error] [pid 32761:tid 32761] [client 185.201.136.17:18337] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:05:27.265245 2026] [security2:error] [pid 32761:tid 32761] [client 185.201.136.17:18337] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/posts/4284"] [unique_id "avMWlyohiLkhPsv4HOSD7gAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 07:19:18
UTC ·
(11 hours ago)
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 02:19:14.717521 2026] [security2:error] [pid 3101:tid 3101] [client 185.201.136.17:35685] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 02:19:14.717521 2026] [security2:error] [pid 3101:tid 3101] [client 185.201.136.17:35685] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.10bestattorneys.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.10bestattorneys.com"] [uri "/employment-laws.htm"] [unique_id "avLFcqxGUVyC78seiMwHYQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 05:22:56
UTC ·
(13 hours ago)
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 00:22:49.136867 2026] [security2:error] [pid 16771:tid 16771] [client 185.201.136.17:35183] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 00:22:49.136867 2026] [security2:error] [pid 16771:tid 16771] [client 185.201.136.17:35183] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.misscharlottemusic.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.misscharlottemusic.com"] [uri "/yourweeklylisten/music/emi-sunshine-9-year-old-country-singer-kicks-it-out-of-the-park/"] [unique_id "avKqKf0QSoL4zF3HX5bfOQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-06 01:11:09
UTC ·
(4 days ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 17:41:34
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 12:41:28.705782 2026] [security2:error] [pid 1395:tid 1421] [client 185.201.136.17:65163] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 12:41:28.705782 2026] [security2:error] [pid 1395:tid 1421] [client 185.201.136.17:65163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.12am.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.12am.com"] [uri "/arshot.htm"] [unique_id "auocyDyFdVaHPL7cu2C-kAAAAFg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 09:13:13
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 05:13:08.932762 2026] [security2:error] [pid 10171:tid 10171] [client 185.201.136.17:62953] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 05:13:08.932762 2026] [security2:error] [pid 10171:tid 10171] [client 185.201.136.17:62953] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||nrvoutdoors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "nrvoutdoors.com"] [uri "/SERGEANT W/SERGEANT W.htm"] [unique_id "auWxJEBXYEDwh0qVEG-PbAAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 22:27:25
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 18:27:19.079006 2026] [security2:error] [pid 6549:tid 6549] [client 185.201.136.17:23423] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 18:27:19.079006 2026] [security2:error] [pid 6549:tid 6549] [client 185.201.136.17:23423] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||georgewmartin.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "georgewmartin.com"] [uri "/Biographies.htm"] [unique_id "auJ2x1cWRwcaVoZ-8J2pBAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 21:58:06
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 17:57:59.388856 2026] [security2:error] [pid 16564:tid 16564] [client 185.201.136.17:34601] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 17:57:59.388856 2026] [security2:error] [pid 16564:tid 16564] [client 185.201.136.17:34601] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||wendeenicole.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "wendeenicole.com"] [uri "/outline.htm"] [unique_id "auJv5yznmZp4XGfE0Arj8QAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 14:11:01
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 10:10:56.704616 2026] [security2:error] [pid 4102:tid 4102] [client 185.201.136.17:16519] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 10:10:56.704616 2026] [security2:error] [pid 4102:tid 4102] [client 185.201.136.17:16519] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||sobhrach.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "sobhrach.com"] [uri "/photos/PCUpdate/respumpandcards.html"] [unique_id "auICcHq9pBtb3HLldhYXeQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
mrcrassi
2026-10-21 14:04:07
UTC ·
(2 weeks ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
T ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇪🇸
librebit
2026-07-09 06:14:14
UTC ·
(4 months ago)
Brute force
Brute-Force
🇫🇷
Tilellit.PRO
2026-06-17 20:24:41
UTC ·
(4 months ago)
Fail2Ban banned 185.201.136.17 for security violations in jail wp-armour. Log: 2026/06/17 20:24:41 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 185.201.136.17 | Target: wplogin" , client: 185.201.136.17, server: [REDACTED], reque ...
show more
Fail2Ban banned 185.201.136.17 for security violations in jail wp-armour. Log: 2026/06/17 20:24:41 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 185.201.136.17 | Target: wplogin" , client: 185.201.136.17, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇪🇸
librebit
2026-06-15 01:56:18
UTC ·
(4 months ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-05-15 23:53:12
UTC ·
(5 months ago)
(mod_security) mod_security (id:211030) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 19:53:05.730164 2026] [security2:error] [pid 32065:tid 32065] [client 185.201.136.17:12001] ...
show more
(mod_security) mod_security (id:211030) triggered by 185.201.136.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 19:53:05.730164 2026] [security2:error] [pid 32065:tid 32065] [client 185.201.136.17:12001] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at ARGS. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "17"] [id "211030"] [rev "3"] [msg "COMODO WAF: LDAP Injection Attack||www.genesis-castle.com|F|2"] [data "Matched Data: (%'%~%'%|%|%( found within ARGS: 0"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "www.genesis-castle.com"] [uri "/gallery/index.php"] [unique_id "agex4WltTaZYpyWnPTxPwAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Hans Wurst
2026-05-05 16:06:20
UTC ·
(6 months ago)
Many 404-Error: Suspicion of URL-Fuzzing/Bot-Scan.
Web App Attack
