🇺🇸
TPI-Abuse
2026-11-12 05:04:10
UTC ·
(23 hours ago)
(mod_security) mod_security (id:210350) triggered by 185.61.223.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 00:04:05.113931 2026] [security2:error] [pid 6956:tid 6956] [client 185.61.223.28:30431] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.223.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 00:04:05.113931 2026] [security2:error] [pid 6956:tid 6956] [client 185.61.223.28:30431] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.mosheimlib.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.mosheimlib.org"] [uri "/wp-content/plugins/modal-popup-box/assets/js/modal/modernizr.custom.js"] [unique_id "avVIxRhF9jE8WaMdYs9ezwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 20:49:43
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.61.223.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 15:49:38.255265 2026] [security2:error] [pid 12655:tid 12655] [client 185.61.223.28:40305] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.223.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 15:49:38.255265 2026] [security2:error] [pid 12655:tid 12655] [client 185.61.223.28:40305] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||tobyjohnson.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "tobyjohnson.com"] [uri "/the-truth-about-religion.html"] [unique_id "auuaYsmRPfSH2xYiGseOCQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-04 01:54:36
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇩🇪
big-cloud.nl
2026-11-03 17:52:43
UTC ·
(1 week ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 04:47:10
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.61.223.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 23:47:03.098906 2026] [security2:error] [pid 2429234:tid 2429260] [client 185.61.223.28:5297 ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.223.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 23:47:03.098906 2026] [security2:error] [pid 2429234:tid 2429260] [client 185.61.223.28:52979] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.killasgarage.bike|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.killasgarage.bike"] [uri "/uncategorized/sram-etap-battery-broken-tab-repair/"] [unique_id "aulnR5ZoBIUv4nL0uM6ZSQAAAFg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-10-29 21:00:14
UTC ·
(2 weeks ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-10-29 15:55:06
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.61.223.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 11:54:57.209687 2026] [security2:error] [pid 4166:tid 4166] [client 185.61.223.28:61809] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.223.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 11:54:57.209687 2026] [security2:error] [pid 4166:tid 4166] [client 185.61.223.28:61809] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||acmax.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "acmax.com"] [uri "/home/index.php/pressure-switches/pressure-switches-general/lfs-01"] [unique_id "auNsUZh0hjh_B99aoNtBOgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 20:42:46
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.61.223.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 16:42:41.561162 2026] [security2:error] [pid 17924:tid 17924] [client 185.61.223.28:37737] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.61.223.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 16:42:41.561162 2026] [security2:error] [pid 17924:tid 17924] [client 185.61.223.28:37737] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.fastquizmaker.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fastquizmaker.com"] [uri "/practice-1873-science.php"] [unique_id "auJeQWUQA2Mi0RHVKVJppgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-04 14:04:03
UTC ·
(1 month ago)
WordPress attack-tool calls | method: POST | path: /xmlrpc.php | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
Web App Attack
Hacking
🇫🇷
Sklurk
2026-09-29 09:03:05
UTC ·
(1 month ago)
Web App Attack
Web App Attack
2026-08-13 01:06:37
UTC ·
(3 months ago)
IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030) MV:0
Hacking
🇮🇹
[email protected]
2026-05-04 19:57:31
UTC ·
(6 months ago)
[Mon May 04 21:57:31.457231 2026] [authz_core:error] [pid 1616931:tid 1616944] [remote 185.61.223.28:31139] AH01630: client denied by server configuration: /var/www/html/MyWeb/Wordpress_www/wp-login.php
...
Brute-Force
Web App Attack
🇲🇹
Malta
2026-04-14 17:57:38
UTC ·
(6 months ago)
185.61.223.28 - - [14/Apr/2026:19:57:37 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.207 Safari/537.36"
Hacking
Web App Attack
VPN IP
🇺🇸
www.winos.me
2026-03-10 20:05:02
UTC ·
(8 months ago)
Banned due to high error rate on HTTP/1.1 protocol
Brute-Force
Web App Attack
🇺🇸
ph
2026-03-03 21:14:32
UTC ·
(8 months ago)
Bad web bot attempting to run wp-json on non-WP site
Hacking
Bad Web Bot
Web App Attack
