🇺🇸
TPI-Abuse
2026-11-13 04:26:50
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 23:26:45.281067 2026] [security2:error] [pid 21322:tid 21322] [client 185.61.216.52:36379] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 23:26:45.281067 2026] [security2:error] [pid 21322:tid 21322] [client 185.61.216.52:36379] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.lasertherapyoc.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.lasertherapyoc.com"] [uri "/testimonials/"] [unique_id "avaRhcCH81ui9ZCSwg6aiAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 20:17:56
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:17:47.068222 2026] [security2:error] [pid 14808:tid 14939] [client 185.61.216.52:60921] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:17:47.068222 2026] [security2:error] [pid 14808:tid 14939] [client 185.61.216.52:60921] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||davidtung.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "davidtung.com"] [uri "/highratio.htm"] [unique_id "avYe6znIfNx2oO_cLYEkNgAAAdI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-10 20:00:14
UTC ·
(4 days ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-10-30 04:01:57
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 00:01:53.065442 2026] [security2:error] [pid 13854:tid 13854] [client 185.61.216.52:43297] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 00:01:53.065442 2026] [security2:error] [pid 13854:tid 13854] [client 185.61.216.52:43297] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||marxistphilosophy.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "marxistphilosophy.org"] [uri "/Hongqi/75/197503-20.htm"] [unique_id "auQWsWa3esPlsC6g4ZyVWAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 11:57:23
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 07:57:18.968296 2026] [security2:error] [pid 14051:tid 14051] [client 185.61.216.52:50539] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 07:57:18.968296 2026] [security2:error] [pid 14051:tid 14051] [client 185.61.216.52:50539] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/tag/afghanistan/page/4/"] [unique_id "auM0noDzDyjb0CllTvSrfAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 10:51:48
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 06:51:42.887638 2026] [security2:error] [pid 10007:tid 10007] [client 185.61.216.52:14079] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 06:51:42.887638 2026] [security2:error] [pid 10007:tid 10007] [client 185.61.216.52:14079] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.flavornet.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.flavornet.org"] [uri "/info/3581-91-7.html"] [unique_id "auMlPoipMqZBtjz3QVE5UgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 01:17:14
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 21:17:07.717508 2026] [security2:error] [pid 24242:tid 24242] [client 185.61.216.52:37183] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 21:17:07.717508 2026] [security2:error] [pid 24242:tid 24242] [client 185.61.216.52:37183] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||kathyquan.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "kathyquan.com"] [uri "/my_books.html"] [unique_id "auFNE_CNZIGUxAOaOlVwhAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
DRI
2026-07-26 05:08:15
UTC ·
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇨🇭
backslash
2026-07-20 00:06:02
UTC ·
(3 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-15 14:22:43
UTC ·
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 10:22:38.071830 2026] [security2:error] [pid 20723:tid 20723] [client 185.61.216.52:30365] M ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.216.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 10:22:38.071830 2026] [security2:error] [pid 20723:tid 20723] [client 185.61.216.52:30365] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||calvarycavaliers.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "calvarycavaliers.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aleXrrWhqvZNiHYp-dk3_gAAABo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
Origon
2026-05-13 22:16:04
UTC ·
(6 months ago)
http-bad-user-agent - IP: 185.61.216.52 - time="2026-05-14T00:16:04+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-bad-user-agent by ip 185.61.216.52 (RU/35830) : 4h ban on Ip 185.61.216.52" mod ...
show more
http-bad-user-agent - IP: 185.61.216.52 - time="2026-05-14T00:16:04+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-bad-user-agent by ip 185.61.216.52 (RU/35830) : 4h ban on Ip 185.61.216.52" module=db
show less
Bad Web Bot
🇺🇸
xmission.com
2025-09-20 09:52:43
UTC ·
(1 year ago)
185.61.216.52 - - [20/Sep/2025:03:52:43 -0600] "POST /wp-login.php HTTP/1.1" 200 2272 "https://dooce.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203 ...
show more
185.61.216.52 - - [20/Sep/2025:03:52:43 -0600] "POST /wp-login.php HTTP/1.1" 200 2272 "https://dooce.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203"
...
show less
Brute-Force
2025-04-25 06:37:54
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-04-17 10:00:00
UTC ·
(1 year ago)
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ...
show more
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user”
show less
Hacking
Brute-Force
Web App Attack
2025-04-17 10:00:00
UTC ·
(1 year ago)
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ...
show more
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user “
show less
Hacking
Brute-Force
Web App Attack
