🇺🇸
TPI-Abuse
2026-11-07 19:58:10
UTC ·
(13 hours ago)
(mod_security) mod_security (id:210350) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 14:58:03.229373 2026] [security2:error] [pid 25903:tid 25903] [client 185.61.216.24:27497] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 14:58:03.229373 2026] [security2:error] [pid 25903:tid 25903] [client 185.61.216.24:27497] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2013/07/06/foreign-policy-broadway-musical/"] [unique_id "au-CywvgLlBWrYShauKE4wAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 12:57:16
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 07:57:08.971707 2026] [security2:error] [pid 29249:tid 29249] [client 185.61.216.24:45501] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 07:57:08.971707 2026] [security2:error] [pid 29249:tid 29249] [client 185.61.216.24:45501] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||bahamascruisersguide.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bahamascruisersguide.com"] [uri "/How-to-Use/How-to-Use.html"] [unique_id "aux9JBhBYZyMtWi4LsNuXAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 15:09:09
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 10:09:04.075405 2026] [security2:error] [pid 12777:tid 12777] [client 185.61.216.24:33633] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 10:09:04.075405 2026] [security2:error] [pid 12777:tid 12777] [client 185.61.216.24:33633] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.nexthop.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.nexthop.com"] [uri "/products/gated.shtml"] [unique_id "auinkATsJWlS3LfpswoPqwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-01 00:08:32
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 04:23:02
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 00:22:58.219337 2026] [security2:error] [pid 28436:tid 28436] [client 185.61.216.24:9455] Mo ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 00:22:58.219337 2026] [security2:error] [pid 28436:tid 28436] [client 185.61.216.24:9455] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.flavornet.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.flavornet.org"] [uri "/info/80466-34-8.html"] [unique_id "auLKIgIOy0SFjnYdcQabygAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 03:25:00
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 23:24:57.642482 2026] [security2:error] [pid 5428:tid 5428] [client 185.61.216.24:24181] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 23:24:57.642482 2026] [security2:error] [pid 5428:tid 5428] [client 185.61.216.24:24181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||harmonyfactor.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "harmonyfactor.com"] [uri "/page29.html"] [unique_id "auFrCR-umw8NhGRab9Ff8wAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ph
2026-08-13 00:09:34
UTC ·
(2 months ago)
Bad web bot attempting to run xmlrpc.php on non-WP site
Hacking
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-06-06 23:45:15
UTC ·
(5 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇫🇮
inlink.ltd
2026-05-20 07:10:25
UTC ·
(5 months ago)
Known malicious PHP file or CMS probe
Web App Attack
🇺🇸
TPI-Abuse
2026-05-09 23:37:30
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 19:37:24.675196 2026] [security2:error] [pid 26443:tid 26443] [client 185.61.216.24:16711] M ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 19:37:24.675196 2026] [security2:error] [pid 26443:tid 26443] [client 185.61.216.24:16711] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||alan-ip.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "alan-ip.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af_FNDXUV1PRlyZMDMsCfQAAABY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 18:56:43
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 14:56:36.172351 2026] [security2:error] [pid 23649:tid 23649] [client 185.61.216.24:15583] M ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 14:56:36.172351 2026] [security2:error] [pid 23649:tid 23649] [client 185.61.216.24:15583] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thoughtage.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thoughtage.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af4x5BmRtfwims96LBTRUAAAABA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 03:27:13
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 23:27:05.068459 2026] [security2:error] [pid 1711:tid 1711] [client 185.61.216.24:17009] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 23:27:05.068459 2026] [security2:error] [pid 1711:tid 1711] [client 185.61.216.24:17009] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thegamblefamily.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thegamblefamily.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adCFCXd-ZF-ojVi02VzjLwAAAAE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-02 21:10:50
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 17:10:45.915395 2026] [security2:error] [pid 3519:tid 3655] [client 185.61.216.24:43249] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 17:10:45.915395 2026] [security2:error] [pid 3519:tid 3655] [client 185.61.216.24:43249] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||swizzlestick.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "swizzlestick.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ac7bVcnOqMfVxqcG8mVzIAAAAJY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-02 00:40:08
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 20:40:01.442860 2026] [security2:error] [pid 14806:tid 14806] [client 185.61.216.24:56577] M ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.216.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 20:40:01.442860 2026] [security2:error] [pid 14806:tid 14806] [client 185.61.216.24:56577] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||intermixx.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "intermixx.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ac264ZLBTEW4U9gMA6O4XwAAAA0"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
SSH-Admin
2026-02-07 17:12:28
UTC ·
(9 months ago)
Probing for Exploits
Exploited Host
Web App Attack
