185.89.43.49

(mod_security) mod_security (id:210350) triggered by 185.89.43.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 02:27:46.282325 2026] [security2:error] [pid 20105:tid 20230] [client 185.89.43.49:64783] Mod ... show more (mod_security) mod_security (id:210350) triggered by 185.89.43.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 02:27:46.282325 2026] [security2:error] [pid 20105:tid 20230] [client 185.89.43.49:64783] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.howardhallis.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.howardhallis.com"] [uri "/POE/tpoeB.html"] [unique_id "au2Bcp0XeRU4h_DvHrnEowAAAYY"] show less

(mod_security) mod_security (id:210350) triggered by 185.89.43.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 09:47:31.989801 2026] [security2:error] [pid 23433:tid 23433] [client 185.89.43.49:21073] Mod ... show more (mod_security) mod_security (id:210350) triggered by 185.89.43.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 09:47:31.989801 2026] [security2:error] [pid 23433:tid 23433] [client 185.89.43.49:21073] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||museum.henning.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "museum.henning.org"] [uri "/anu002/"] [unique_id "auSf89Zz_y7RJbgyXcSjVAAAAB8"] show less

(mod_security) mod_security (id:210350) triggered by 185.89.43.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 20:30:08.475272 2026] [security2:error] [pid 18191:tid 18191] [client 185.89.43.49:25389] Mod ... show more (mod_security) mod_security (id:210350) triggered by 185.89.43.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 20:30:08.475272 2026] [security2:error] [pid 18191:tid 18191] [client 185.89.43.49:25389] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||stansco.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "stansco.com"] [uri "/netchess/rules.html"] [unique_id "atqqkLnNxVDemF3JkzkJkgAAAAA"] show less

(mod_security) mod_security (id:210350) triggered by 185.89.43.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 01:42:59.291503 2026] [security2:error] [pid 27520:tid 27520] [client 185.89.43.49:31243] Mod ... show more (mod_security) mod_security (id:210350) triggered by 185.89.43.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 01:42:59.291503 2026] [security2:error] [pid 27520:tid 27520] [client 185.89.43.49:31243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.powerkiteforum.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.powerkiteforum.com"] [uri "/viewthread.php"] [unique_id "athQ44mc0FISyg0LTfBQnQAAAAc"] show less

(mod_security) mod_security (id:210350) triggered by 185.89.43.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:16:52.030332 2026] [security2:error] [pid 4508:tid 4508] [client 185.89.43.49:9105] ModSec ... show more (mod_security) mod_security (id:210350) triggered by 185.89.43.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:16:52.030332 2026] [security2:error] [pid 4508:tid 4508] [client 185.89.43.49:9105] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.transparentforest.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.transparentforest.com"] [uri "/blog/"] [unique_id "atDgVLiUG6k7r9koBlLKJwAAACk"] show less

Distributed scraping attack: 3436 req from 3224 rotating proxy IPs, waves of up to 156 req in 138s on a single URL | this IP: 1 req, 1 blocked

wordpress-fuzzing

(mod_security) mod_security (id:225170) triggered by 185.89.43.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 23:36:48.917942 2026] [security2:error] [pid 17424:tid 17424] [client 185.89.43.49:56059] Mod ... show more (mod_security) mod_security (id:225170) triggered by 185.89.43.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 23:36:48.917942 2026] [security2:error] [pid 17424:tid 17424] [client 185.89.43.49:56059] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fnavarro.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fnavarro.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acnv0AhVONX2NGY9rWMSKgAAAAg"], referer: https://www.google.com show less

Attempted brute force login to web vpn 2 time(s); last attempt for 2025.09.28 is noted in report timestamp

Attempted brute force login to web vpn 1 time(s); last attempt for 2025.09.26 is noted in report timestamp

Unauthorized VPN login attempts: 1 attempts were recorded from 185.89.43.49 2025-05-09T18:37:50+02:00 vpn Access-Reject 'maryann' station: 185.89.43.49 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted> ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 185.89.43.49 2025-05-09T18:37:50+02:00 vpn Access-Reject 'maryann' station: 185.89.43.49 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less

Unauthorized VPN login attempts: 1 attempts were recorded from 185.89.43.49 2025-05-07T06:24:16+02:00 vpn Access-Reject 'draco' station: 185.89.43.49 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'

This IP was involved in an brute force and password spray attack on 2025/03/28 08:29:39

Unauthorized VPN login attempts: 1 attempts were recorded from 185.89.43.49 2025-03-17T01:41:32+01:00 vpn Access-Reject 'kickbox' station: 185.89.43.49 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted> ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 185.89.43.49 2025-03-17T01:41:32+01:00 vpn Access-Reject 'kickbox' station: 185.89.43.49 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less

Unauthorized VPN login attempts: 1 attempts were recorded from 185.89.43.49 2025-03-15T02:39:58+01:00 vpn Access-Reject 'charly' station: 185.89.43.49 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'