🇺🇸
TPI-Abuse
2026-11-15 03:19:28
UTC ·
(45 minutes ago)
(mod_security) mod_security (id:210350) triggered by 185.61.223.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 22:19:23.802469 2026] [security2:error] [pid 24714:tid 24714] [client 185.61.223.166:12219] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.223.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 22:19:23.802469 2026] [security2:error] [pid 24714:tid 24714] [client 185.61.223.166:12219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.chriscollinsplumbing.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.chriscollinsplumbing.com"] [uri "/rw_common/themes/o_mega_1.1/js/jquery-1.2.6.min.js"] [unique_id "avkkuwXHrMEFqgGXrnKTUgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-14 12:00:14
UTC ·
(16 hours ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-12 02:17:10
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 185.61.223.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 21:17:07.822711 2026] [security2:error] [pid 5255:tid 5255] [client 185.61.223.166:34037] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.223.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 21:17:07.822711 2026] [security2:error] [pid 5255:tid 5255] [client 185.61.223.166:34037] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rogerg.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rogerg.com"] [uri "/books/C/Cornwell, Patricia - Scarpetta 03 - All That Remains.prc"] [unique_id "avUho88v0yrU6yZos_7YggAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 10:45:12
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 185.61.223.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:45:05.596327 2026] [security2:error] [pid 1012:tid 1012] [client 185.61.223.166:36553] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.223.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:45:05.596327 2026] [security2:error] [pid 1012:tid 1012] [client 185.61.223.166:36553] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.disio.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.disio.com"] [uri "/sign-up-2/bagarre-femme-garcon-comme-accaparez-cet-veine-qu/"] [unique_id "avL1sfyPGlHrv74v8Z6ZgAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-04 00:48:36
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 18:38:13
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.61.223.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:38:08.022856 2026] [security2:error] [pid 7204:tid 7204] [client 185.61.223.166:33841] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.223.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 14:38:08.022856 2026] [security2:error] [pid 7204:tid 7204] [client 185.61.223.166:33841] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ctrussell.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ctrussell.us"] [uri "/ctrussell/ctrussell.nsf/22284ee7f683acc9862566bd000b278c/df27e5fc4ce0012a862566c50014e89a"] [unique_id "auJBEOETNZTW1nYCjIYX_gAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 08:36:06
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.61.223.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 04:35:58.574305 2026] [security2:error] [pid 12088:tid 12088] [client 185.61.223.166:31265] ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.223.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 04:35:58.574305 2026] [security2:error] [pid 12088:tid 12088] [client 185.61.223.166:31265] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||cmgpartners.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cmgpartners.com"] [uri "/index.php"] [unique_id "atscbhEBJUHlk19VBwYYkQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-10-12 10:28:10
UTC ·
(1 month ago)
Try to access /xmlrpc.php
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-12 04:50:44
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 2 attempts were recorded from 185.61.223.166
2026-09-12T06:29:17+02:00 vpn Access-Reject 'turgut' station: 185.61.223.166 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redact ...
show more
Unauthorized VPN login attempts: 2 attempts were recorded from 185.61.223.166
2026-09-12T06:29:17+02:00 vpn Access-Reject 'turgut' station: 185.61.223.166 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-12T06:30:51+02:00 vpn Access-Reject 'dincer' station: 185.61.223.166 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
lp
2026-09-10 06:22:10
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 185.61.223.166
2026-09-10T08:15:47+02:00 vpn Access-Reject 'Stephne' station: 185.61.223.166 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redac ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 185.61.223.166
2026-09-10T08:15:47+02:00 vpn Access-Reject 'Stephne' station: 185.61.223.166 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-09-10 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
2026-07-31 16:32:04
UTC ·
(3 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇺🇸
rsiddall
2026-07-31 12:20:20
UTC ·
(3 months ago)
185.61.223.166 - - [31/Jul/2026:08:20:18 -0400] "POST /xmlrpc.php HTTP/1.1" 403 1809 "-" "Apache-HttpClient/4.5.13 (Java/11.0.31)"
185.61.223.166 - - [31/Jul/2026:08:20:19 -0400] "POST /xmlrpc.php HTTP/1.1" 403 1809 "-" "Apache-HttpClient/4.5.13 (Jav ...
show more
185.61.223.166 - - [31/Jul/2026:08:20:18 -0400] "POST /xmlrpc.php HTTP/1.1" 403 1809 "-" "Apache-HttpClient/4.5.13 (Java/11.0.31)"
185.61.223.166 - - [31/Jul/2026:08:20:19 -0400] "POST /xmlrpc.php HTTP/1.1" 403 1809 "-" "Apache-HttpClient/4.5.13 (Java/11.0.31)"
...
show less
Brute-Force
🇨🇦
DRI
2026-07-31 04:04:38
UTC ·
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
