🇺🇸
TPI-Abuse
2026-11-12 01:22:53
UTC ·
(7 hours ago)
(mod_security) mod_security (id:210350) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 20:22:50.322071 2026] [security2:error] [pid 32702:tid 32702] [client 185.202.108.49:23989] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 20:22:50.322071 2026] [security2:error] [pid 32702:tid 32702] [client 185.202.108.49:23989] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||forum.whodatnation.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "forum.whodatnation.com"] [uri "/cron.php"] [unique_id "avUU6gFB7MLBwoYDf1cEqAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 00:35:43
UTC ·
(8 hours ago)
(mod_security) mod_security (id:210350) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 19:35:36.128655 2026] [security2:error] [pid 16367:tid 16367] [client 185.202.108.49:51817] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 19:35:36.128655 2026] [security2:error] [pid 16367:tid 16367] [client 185.202.108.49:51817] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.caferutadelaseda.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.caferutadelaseda.com"] [uri "/images/source/helpers/assets/owlcarousel/images/js/menu.js"] [unique_id "avUJ2A7txUz_J5K9jrWwSwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 01:57:55
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:57:49.935624 2026] [security2:error] [pid 1800690:tid 1800818] [client 185.202.108.49:22 ...
show more
(mod_security) mod_security (id:210350) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:57:49.935624 2026] [security2:error] [pid 1800690:tid 1800818] [client 185.202.108.49:22857] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aafm.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aafm.org"] [uri "/Certified-Accredited-Financial-Analyst-AFA-Degree-Diploma-Programs.html"] [unique_id "avPLncSWTSUERBuQRAoJGgAAAQU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 11:12:30
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:12:24.989585 2026] [security2:error] [pid 14447:tid 14447] [client 185.202.108.49:57679] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:12:24.989585 2026] [security2:error] [pid 14447:tid 14447] [client 185.202.108.49:57679] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bodybuildbid.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bodybuildbid.com"] [uri "/articles/bodyart/bodybuilding-art-steve.html"] [unique_id "avL8GJ6QMTM_8sCRaapHXwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-02 00:37:42
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 10:37:03
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 06:36:56.523017 2026] [security2:error] [pid 18844:tid 18844] [client 185.202.108.49:49787] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 06:36:56.523017 2026] [security2:error] [pid 18844:tid 18844] [client 185.202.108.49:49787] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/tag/obesity/"] [unique_id "auRzSDVZ2sf-6vh3PoONxQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-10-21 13:54:24
UTC ·
(3 weeks ago)
Brute-force login attack detected by WordPress firewall.
Brute-Force
Web App Attack
🇩🇪
FD-IX
2026-08-18 11:04:17
UTC ·
(2 months ago)
Brute-force login attack detected by WordPress firewall.
Brute-Force
Web App Attack
🇫🇮
JimArchon72
2026-06-16 01:15:03
UTC ·
(4 months ago)
2026/06/16 01:11:37 "GET /wp-login.php?action=register HTTP/1.1"
Web App Attack
🇺🇸
ambor
2026-05-30 08:59:39
UTC ·
(5 months ago)
Honeypot access: WordPress admin access attempt. Path: /wp-login.php
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-01-14 11:55:26
UTC ·
(9 months ago)
(mod_security) mod_security (id:210350) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 06:55:21.124572 2026] [security2:error] [pid 3884776:tid 3884776] [client 185.202.108.49:25 ...
show more
(mod_security) mod_security (id:210350) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 06:55:21.124572 2026] [security2:error] [pid 3884776:tid 3884776] [client 185.202.108.49:25537] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||btsalesrep.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "btsalesrep.com"] [uri "/"] [unique_id "aWeEKZpj5ZeCaVMUl_ZhwgAAAAc"], referer: http://btsalesrep.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-08-20 03:24:54
UTC ·
(1 year ago)
Attempted access to sensitive endpoint (/xmlrpc.php) detected. Automated scan or unauthorized probing.
Web App Attack
🇨🇦
wil.com
2025-03-28 08:36:35
UTC ·
(1 year ago)
GlobalProtect login attempts with user JESSEB.
VPN IP
Brute-Force
🇺🇸
TPI-Abuse
2025-03-19 01:58:55
UTC ·
(1 year ago)
(mod_security) mod_security (id:211120) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 18 21:58:45.728405 2025] [security2:error] [pid 960896:tid 960896] [client 185.202.108.49:5956 ...
show more
(mod_security) mod_security (id:211120) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 18 21:58:45.728405 2025] [security2:error] [pid 960896:tid 960896] [client 185.202.108.49:59565] [client 185.202.108.49] ModSecurity: Access denied with code 403 (phase 2). Match of "endsWith /modules/paypal/express_checkout/payment.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "29"] [id "211120"] [rev "11"] [msg "COMODO WAF: Remote File Inclusion Attack||asapsmogcheck.com|F|2"] [data "Matched Data: http://adguard.digital/payload/index.php? found within REQUEST_FILENAME: /wp-content/plugins/all-in-one-seo-pack/classes/aiosp.class.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "asapsmogcheck.com"] [uri "/wp-content/plugins/all-in-one-seo-pack/classes/aiosp.class.php"] [unique_id "Z9ok1X_1SvUrOX1k620WBQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-03-17 23:49:45
UTC ·
(1 year ago)
(mod_security) mod_security (id:211120) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 17 19:49:40.760655 2025] [security2:error] [pid 16467:tid 16467] [client 185.202.108.49:29117] ...
show more
(mod_security) mod_security (id:211120) triggered by 185.202.108.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 17 19:49:40.760655 2025] [security2:error] [pid 16467:tid 16467] [client 185.202.108.49:29117] [client 185.202.108.49] ModSecurity: Access denied with code 403 (phase 2). Match of "endsWith /modules/paypal/express_checkout/payment.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "29"] [id "211120"] [rev "12"] [msg "COMODO WAF: Remote File Inclusion Attack||arellasoc.com|F|2"] [data "Matched Data: http://adguard.digital/payload/index.php? found within REQUEST_FILENAME: /wp-content/plugins/all-in-one-seo-pack/classes/aiosp.class.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arellasoc.com"] [uri "/wp-content/plugins/all-in-one-seo-pack/classes/aiosp.class.php"] [unique_id "Z9i1FEmwJeZHyqcoC25NUQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
