🇺🇸
TPI-Abuse
2026-11-15 09:36:49
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210350) triggered by 185.96.37.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 04:36:43.846551 2026] [security2:error] [pid 7137:tid 7137] [client 185.96.37.109:20503] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.96.37.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 04:36:43.846551 2026] [security2:error] [pid 7137:tid 7137] [client 185.96.37.109:20503] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ofertasdetrabajosyempleos.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ofertasdetrabajosyempleos.com"] [uri "/mexico/buscador-irapuato-irapuato.php"] [unique_id "avl9KwUln8-Vfo-eVsnK3QAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-08 00:54:59
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 00:32:44
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.96.37.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 19:32:40.265717 2026] [security2:error] [pid 26275:tid 26275] [client 185.96.37.109:25571] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.96.37.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 19:32:40.265717 2026] [security2:error] [pid 26275:tid 26275] [client 185.96.37.109:25571] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/posts/4777"] [unique_id "au5xqKUCHL5vU8YrSS4f8gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-07 00:23:33
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 04:24:58
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.96.37.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 00:24:50.404325 2026] [security2:error] [pid 20934:tid 20934] [client 185.96.37.109:18345] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.96.37.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 00:24:50.404325 2026] [security2:error] [pid 20934:tid 20934] [client 185.96.37.109:18345] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||angeltarrac.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "angeltarrac.com"] [uri "/guest-artists/Albarran02/albarran-biography.htm"] [unique_id "atrhkmn0gZ4yRo-fm6nYMwAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-27 21:17:58
UTC ·
(1 month ago)
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack t ...
show more
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack tools, blocked on sight. Please check the machine behind it. | method: GET | path: /wp-login.php | 2026-09-27 21:17 UTC
show less
Web App Attack
Hacking
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
2026-07-05 19:22:19
UTC ·
(4 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇧🇪
Saec
2026-06-19 08:30:16
UTC ·
(4 months ago)
Jarvis auto-ban: CF honeypot path /xmlrpc.php (3× on saec.me)
Port Scan
Web App Attack
🇨🇭
4server
2026-04-23 05:17:28
UTC ·
(6 months ago)
[ThuApr2307:17:20.9079462026][security2:error][pid2472244:tid2472329][client185.96.37.109:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-B ...
show more
[ThuApr2307:17:20.9079462026][security2:error][pid2472244:tid2472329][client185.96.37.109:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"duoacaja.com\"][uri\"/robots.txt\"][unique_id\"aemrYPNFZ2IDRlAKVFbozwAAAUE\"]\,referer:http://duoacaja.com/robots.txt
show less
Hacking
Web App Attack
🇳🇱
Roderic
2026-04-02 01:14:54
UTC ·
(7 months ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted])
Bad Web Bot
🇺🇸
TPI-Abuse
2025-10-12 11:58:51
UTC ·
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 185.96.37.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 12 07:58:45.772531 2025] [security2:error] [pid 12566:tid 12566] [client 185.96.37.109:53799] M ...
show more
(mod_security) mod_security (id:225170) triggered by 185.96.37.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 12 07:58:45.772531 2025] [security2:error] [pid 12566:tid 12566] [client 185.96.37.109:53799] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||admin.turedinmobiliaria.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "admin.turedinmobiliaria.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aOuX9afCgBvtjfByUrcA3wAAAAs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇬
pusathosting.com
2025-09-30 09:39:04
UTC ·
(1 year ago)
2ds22 bruteforce
Brute-Force
Web App Attack
2025-04-15 13:22:57
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-04-11 11:02:14
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
