🇺🇸
TPI-Abuse
2026-11-15 03:39:28
UTC ·
(4 hours ago)
(mod_security) mod_security (id:210350) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 22:39:20.486362 2026] [security2:error] [pid 1444:tid 1444] [client 185.201.138.104:38775] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 22:39:20.486362 2026] [security2:error] [pid 1444:tid 1444] [client 185.201.138.104:38775] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.eroticperfection.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.eroticperfection.com"] [uri "/archive005.html"] [unique_id "avkpaOJv4tFrBr5aRH-VcgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 09:26:54
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 04:26:50.316298 2026] [security2:error] [pid 23471:tid 23471] [client 185.201.138.104:5583 ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 04:26:50.316298 2026] [security2:error] [pid 23471:tid 23471] [client 185.201.138.104:55839] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jamesmsmall.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jamesmsmall.com"] [uri "/blog"] [unique_id "avQ02jzjnsmA8I6yqSwUaAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 00:53:40
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 19:53:35.474145 2026] [security2:error] [pid 1649520:tid 1649595] [client 185.201.138.104: ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 19:53:35.474145 2026] [security2:error] [pid 1649520:tid 1649595] [client 185.201.138.104:34019] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aafm.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aafm.org"] [uri "/CFM-Chartered-Financial-Manager.html"] [unique_id "avEZj8bAPOvzmCQ_J_8eUQAAAFg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 20:08:03
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 15:07:57.272504 2026] [security2:error] [pid 29208:tid 29208] [client 185.201.138.104:1846 ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 15:07:57.272504 2026] [security2:error] [pid 29208:tid 29208] [client 185.201.138.104:18467] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "au4znVsTivmW_GDxJogRQwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 09:15:52
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 04:15:46.869277 2026] [security2:error] [pid 12155:tid 12155] [client 185.201.138.104:1813 ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 04:15:46.869277 2026] [security2:error] [pid 12155:tid 12155] [client 185.201.138.104:18137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bodybuildbid.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bodybuildbid.com"] [uri "/articles/nutrition/guide-protein-powder.html"] [unique_id "aummQjUpXmqn3jvOjUiiQAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 01:31:41
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 21:31:38.245814 2026] [security2:error] [pid 19829:tid 19868] [client 185.201.138.104:3046 ...
show more
(mod_security) mod_security (id:210350) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 21:31:38.245814 2026] [security2:error] [pid 19829:tid 19868] [client 185.201.138.104:30465] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||businesscertification.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "businesscertification.org"] [uri "/Management-Consultant-Handbook-059.html"] [unique_id "at_--iXdV2L0Air7lKqPaAAAAgQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
mrcrassi
2026-08-01 14:27:23
UTC ·
(3 months ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
T ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
4server
2026-07-30 01:08:24
UTC ·
(3 months ago)
[ThuJul3003:08:19.3987882026][security2:error][pid2286065:tid2286123][client185.201.138.104:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id ...
show more
[ThuJul3003:08:19.3987882026][security2:error][pid2286065:tid2286123][client185.201.138.104:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"www.gustotondo.ch\"][uri\"/xmlrpc.php\"][unique_id\"amqkAwX8GR2ENt7zHXQmLgAAAE4\"]
show less
Port Scan
Brute-Force
Web App Attack
🇩🇪
kjaerulff
2026-04-14 10:52:24
UTC ·
(7 months ago)
Failed Wordpress login using wp-login.php
Web App Attack
🇺🇸
TPI-Abuse
2026-04-11 15:46:24
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 11:46:20.681158 2026] [security2:error] [pid 2868539:tid 2868539] [client 185.201.138.104: ...
show more
(mod_security) mod_security (id:225170) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 11:46:20.681158 2026] [security2:error] [pid 2868539:tid 2868539] [client 185.201.138.104:48635] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||theboates.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "theboates.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adpszAwlYvNhjgRmE5vEjgAAABI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-09 14:57:33
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 09 10:57:27.426382 2026] [security2:error] [pid 1119081:tid 1119099] [client 185.201.138.104: ...
show more
(mod_security) mod_security (id:225170) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 09 10:57:27.426382 2026] [security2:error] [pid 1119081:tid 1119099] [client 185.201.138.104:63213] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cmykdesign.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cmykdesign.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ade-VwUg24_QpawwvGXadQAAAQ4"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-25 09:24:42
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 05:24:38.017258 2026] [security2:error] [pid 31786:tid 31786] [client 185.201.138.104:2556 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 05:24:38.017258 2026] [security2:error] [pid 31786:tid 31786] [client 185.201.138.104:25567] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||eagrant.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "eagrant.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acOp1paH3m-qAMT-EqNNOQAAAAE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nationaleventpros.com
2026-03-21 22:21:45
UTC ·
(7 months ago)
WordPress login attempt
Brute-Force
🇺🇸
TPI-Abuse
2026-03-04 14:45:00
UTC ·
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 04 09:44:52.718518 2026] [security2:error] [pid 4998:tid 4998] [client 185.201.138.104:50053] ...
show more
(mod_security) mod_security (id:225170) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 04 09:44:52.718518 2026] [security2:error] [pid 4998:tid 4998] [client 185.201.138.104:50053] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||soundtrax.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "soundtrax.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aahFZGIIAgTvPYtuMb7FNQAAAAY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-04 04:46:28
UTC ·
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 03 23:46:22.381246 2026] [security2:error] [pid 11821:tid 11868] [client 185.201.138.104:3584 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.201.138.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 03 23:46:22.381246 2026] [security2:error] [pid 11821:tid 11868] [client 185.201.138.104:35847] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nrgla.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nrgla.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aae5HlD0vCFPcus4lD1CVQAAAJI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
