🇺🇸
TPI-Abuse
2026-11-12 14:04:39
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 185.61.217.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 09:04:35.612045 2026] [security2:error] [pid 2471:tid 2471] [client 185.61.217.108:61335] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.217.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 09:04:35.612045 2026] [security2:error] [pid 2471:tid 2471] [client 185.61.217.108:61335] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||pjv.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "pjv.us"] [uri "/fluxbb-karen/extern.php"] [unique_id "avXHc9MCM6bZoKH1sVhwwAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 04:03:45
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 185.61.217.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 23:03:39.772365 2026] [security2:error] [pid 20088:tid 20088] [client 185.61.217.108:45765] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.217.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 23:03:39.772365 2026] [security2:error] [pid 20088:tid 20088] [client 185.61.217.108:45765] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||keystonebrass.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "keystonebrass.com"] [uri "/Advent Luth.html"] [unique_id "avPpG5WIk6LsFFlRUYPv3AAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 22:58:23
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.61.217.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 17:58:18.719829 2026] [security2:error] [pid 3046:tid 3046] [client 185.61.217.108:15119] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.217.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 17:58:18.719829 2026] [security2:error] [pid 3046:tid 3046] [client 185.61.217.108:15119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/tag/american-dream/"] [unique_id "aupnCnawXUOXE-AMMDYdiQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 08:05:53
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.61.217.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:05:45.842173 2026] [security2:error] [pid 1691:tid 1691] [client 185.61.217.108:22507] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.217.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:05:45.842173 2026] [security2:error] [pid 1691:tid 1691] [client 185.61.217.108:22507] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||asiabeef.network|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "asiabeef.network"] [uri "/interactive-trade-maps.html"] [unique_id "aumV2aYDMTmvdp1zdJgAJQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 20:43:31
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.61.217.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 16:43:27.303968 2026] [security2:error] [pid 12030:tid 12030] [client 185.61.217.108:33973] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.217.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 16:43:27.303968 2026] [security2:error] [pid 12030:tid 12030] [client 185.61.217.108:33973] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.creationorevolution.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.creationorevolution.net"] [uri "/creacorn4/"] [unique_id "at0Yb8T1dfAw4zo7sXji3gAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
zam
2026-08-28 14:35:37
UTC ·
(2 months ago)
185.61.217.108 - - [28/Aug/2026:14:35:30 +0000] "POST /xmlrpc.php HTTP/1.1" 403 239
Web App Attack
🇫🇷
Tilellit.PRO
2026-05-02 19:09:20
UTC ·
(6 months ago)
Fail2Ban banned 185.61.217.108 for security violations in jail wp-armour. Log: 2026/05/02 19:09:19 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 185.61.217.108 | Target: wplogin" , client: 185.61.217.108, server: [REDACTED], reque ...
show more
Fail2Ban banned 185.61.217.108 for security violations in jail wp-armour. Log: 2026/05/02 19:09:19 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 185.61.217.108 | Target: wplogin" , client: 185.61.217.108, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇨🇦
SSH-Admin
2026-02-07 17:12:28
UTC ·
(9 months ago)
Probing for Exploits
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-01-22 13:34:52
UTC ·
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.217.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 08:34:46.776174 2026] [security2:error] [pid 11050:tid 11050] [client 185.61.217.108:38301] ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.217.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 08:34:46.776174 2026] [security2:error] [pid 11050:tid 11050] [client 185.61.217.108:38301] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||dandksupply.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dandksupply.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXIndjPBujDiTdqL6U1r-gAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-01-07 10:29:43
UTC ·
(10 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 185.61.217.108 (US/United States/-): 1 in the last 3600 secs (0-195)
Hacking
🇨🇦
SSH-Admin
2025-12-27 13:45:08
UTC ·
(10 months ago)
Probing for Exploits
Exploited Host
Web App Attack
🇫🇷
masterguru
2025-12-06 06:45:04
UTC ·
(11 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 185.61.217.108 (US/United States/-): 1 in the last 3600 secs (0-193)
Hacking
2025-12-02 02:56:11
UTC ·
(11 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇫🇷
masterguru
2025-11-28 15:54:49
UTC ·
(11 months ago)
(FolderList) Hacking file access attemp in wordpress site from 185.61.217.108 (US/United States/-): 1 in the last 3600 secs (0-195)
Hacking
2025-11-19 06:55:59
UTC ·
(11 months ago)
wordpress-trap
Web App Attack
