🇺🇸
TPI-Abuse
2026-11-06 16:44:23
UTC ·
(49 minutes ago)
(mod_security) mod_security (id:210350) triggered by 185.96.37.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 11:44:17.932364 2026] [security2:error] [pid 24703:tid 24703] [client 185.96.37.136:21371] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.96.37.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 11:44:17.932364 2026] [security2:error] [pid 24703:tid 24703] [client 185.96.37.136:21371] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.partybuseslansing.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.partybuseslansing.com"] [uri "/about-party-buses-lansing.html"] [unique_id "au4D4YLSrHKiLRV16pU3VQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-23 22:42:00
UTC ·
(1 month ago)
[ti-01sc] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 185.96.37.136 - - [24/Sep/2026:00:41:05 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe ...
show more
[ti-01sc] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 185.96.37.136 - - [24/Sep/2026:00:41:05 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
185.96.37.136 - - [24/Sep/2026:00:41:25 +0200] "POST /wp-login.php HTTP/2.0" 200 4487 "https://www.nieuwsvoordietisten.nl/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
185.96.37.136 - - [24/Sep/2026:00:41:28 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
185.96.37.136 - - [24/Sep/2026:00:41:52 +0200] "POST /wp-login.php HTTP/2
...
show less
Brute-Force
Web App Attack
🇺🇸
kosada.com
2026-05-06 14:46:24
UTC ·
(6 months ago)
Web password guessing
Brute-Force
🇺🇸
TPI-Abuse
2026-05-03 10:57:26
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 185.96.37.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 03 06:57:20.900570 2026] [security2:error] [pid 4288:tid 4288] [client 185.96.37.136:42115] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 185.96.37.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 03 06:57:20.900570 2026] [security2:error] [pid 4288:tid 4288] [client 185.96.37.136:42115] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||petrovic4.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "petrovic4.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afcqEM87FlJsqDip9eTVfwAAABU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
ptlab
2026-04-21 02:49:05
UTC ·
(6 months ago)
Detected wp_login attack from WP-host.
Hacking
Web App Attack
🇺🇸
nationaleventpros.com
2026-04-17 11:23:25
UTC ·
(6 months ago)
WordPress login attempt
Brute-Force
🇺🇸
TPI-Abuse
2026-04-17 03:29:18
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 185.96.37.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 16 23:29:11.939593 2026] [security2:error] [pid 677232:tid 677232] [client 185.96.37.136:62475] ...
show more
(mod_security) mod_security (id:225170) triggered by 185.96.37.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 16 23:29:11.939593 2026] [security2:error] [pid 677232:tid 677232] [client 185.96.37.136:62475] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||evelynkay.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "evelynkay.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeGpBwQf4CQRsRRn-vRdiAAAAAI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-04-13 23:09:28
UTC ·
(6 months ago)
Web password guessing
Brute-Force
2025-06-28 09:59:59
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-06-25 00:51:02
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-06-22 03:21:40
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-04-21 08:17:47
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-04-17 10:00:00
UTC ·
(1 year ago)
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ...
show more
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user”
show less
Hacking
Brute-Force
Web App Attack
2025-04-17 10:00:00
UTC ·
(1 year ago)
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ...
show more
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user “
show less
Hacking
Brute-Force
Web App Attack
2025-04-08 14:23:11
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
