🇺🇸
TPI-Abuse
2026-11-09 05:28:52
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 00:28:39.061564 2026] [security2:error] [pid 11151:tid 11151] [client 185.81.145.31:44423] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 00:28:39.061564 2026] [security2:error] [pid 11151:tid 11151] [client 185.81.145.31:44423] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.grupo-visalud.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.grupo-visalud.com"] [uri "/2023/03/ggbet-bukmacher-zaklady-on-line-logowanie-na-stronie-ggbet-polsk/"] [unique_id "avFaB1386yLxKHgBfTPoQAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 18:10:17
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 13:10:03.198421 2026] [security2:error] [pid 23676:tid 23676] [client 185.81.145.31:30115] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 13:10:03.198421 2026] [security2:error] [pid 23676:tid 23676] [client 185.81.145.31:30115] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cortona.ws|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cortona.ws"] [uri "/dintorni_michele_it.html"] [unique_id "auzGe3D7SAaLJ_6u1TArNQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 08:45:15
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 04:44:59.079308 2026] [security2:error] [pid 7333:tid 7333] [client 185.81.145.31:53855] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 04:44:59.079308 2026] [security2:error] [pid 7333:tid 7333] [client 185.81.145.31:53855] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rochesterhistorical.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rochesterhistorical.org"] [uri "/industry/retail/"] [unique_id "auRZC-ctKTTxuJEfKgwPVAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 18:39:35
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 14:39:22.477117 2026] [security2:error] [pid 5059:tid 5059] [client 185.81.145.31:47255] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 14:39:22.477117 2026] [security2:error] [pid 5059:tid 5059] [client 185.81.145.31:47255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2013/01/18/gop-backing-debt-limit-fight/"] [unique_id "auOS2oIRhEa5jhHzTXZXzQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 20:49:21
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 16:49:05.383507 2026] [security2:error] [pid 11661:tid 11661] [client 185.81.145.31:19581] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 16:49:05.383507 2026] [security2:error] [pid 11661:tid 11661] [client 185.81.145.31:19581] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.johnandrews.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.johnandrews.net"] [uri "/index.htm"] [unique_id "at-8wfn7_SnrP2akrYrrNgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 17:26:46
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 13:26:29.381840 2026] [security2:error] [pid 31220:tid 31220] [client 185.81.145.31:16905] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 13:26:29.381840 2026] [security2:error] [pid 31220:tid 31220] [client 185.81.145.31:16905] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ran101.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ran101.com"] [uri "/wakai.htm"] [unique_id "at47xacAFoee4GIfrE3pQQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-09-19 14:11:10
UTC ·
(1 month ago)
Brute-force login attack detected by WordPress firewall.
Brute-Force
🇩🇪
Hazzard
2026-08-24 08:53:49
UTC ·
(2 months ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted]): (CF_ENABLE)
Bad Web Bot
🇩🇪
rh24
2026-05-20 11:54:24
UTC ·
(5 months ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 185.81.145.31 (RU/Russia/-)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-03-18 23:27:36
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 18 19:27:20.052298 2026] [security2:error] [pid 28634:tid 28634] [client 185.81.145.31:48219] M ...
show more
(mod_security) mod_security (id:225170) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 18 19:27:20.052298 2026] [security2:error] [pid 28634:tid 28634] [client 185.81.145.31:48219] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||primacomm.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "primacomm.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abs02LG3B0rfIPF0U0c40gAAAAo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-03-18 13:26:49
UTC ·
(7 months ago)
Web App Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-17 20:15:53
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 17 16:15:23.946259 2026] [security2:error] [pid 22937:tid 22937] [client 185.81.145.31:38855] M ...
show more
(mod_security) mod_security (id:225170) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 17 16:15:23.946259 2026] [security2:error] [pid 22937:tid 22937] [client 185.81.145.31:38855] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||webjemm.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "webjemm.net"] [uri "/wp-json/wp/v2/users"] [unique_id "abm2W3uBHbJScc4pV-sCnAAAAB8"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-28 05:54:42
UTC ·
(9 months ago)
(mod_security) mod_security (id:240335) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 28 00:54:26.395949 2026] [security2:error] [pid 547:tid 547] [client 185.81.145.31:61567] ModSe ...
show more
(mod_security) mod_security (id:240335) triggered by 185.81.145.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 28 00:54:26.395949 2026] [security2:error] [pid 547:tid 547] [client 185.81.145.31:61567] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 185.81.145.31 (+1 hits since last alert)|thestardance.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thestardance.com"] [uri "/xmlrpc.php"] [unique_id "aXmkkqtFK9ZXWF-I9WEOiAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-10-04 19:18:15
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-09-26 03:19:52
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
