193.202.80.128

(mod_security) mod_security (id:210350) triggered by 193.202.80.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 22:41:51.298921 2026] [security2:error] [pid 7117:tid 7117] [client 193.202.80.128:15431] M ... show more (mod_security) mod_security (id:210350) triggered by 193.202.80.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 22:41:51.298921 2026] [security2:error] [pid 7117:tid 7117] [client 193.202.80.128:15431] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||glslightingandcontrols.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "glslightingandcontrols.com"] [uri "/terms-and-conditions.html"] [unique_id "au_vfxHq3y6TVRv2v0wsyAAAAAU"] show less

(mod_security) mod_security (id:210350) triggered by 193.202.80.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 14:47:05.263402 2026] [security2:error] [pid 18874:tid 18874] [client 193.202.80.128:15903] ... show more (mod_security) mod_security (id:210350) triggered by 193.202.80.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 14:47:05.263402 2026] [security2:error] [pid 18874:tid 18874] [client 193.202.80.128:15903] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/tags/415"] [unique_id "auo6OQQs38kELcN5YK_u5gAAAAw"] show less

(mod_security) mod_security (id:210350) triggered by 193.202.80.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 10:55:58.079686 2026] [security2:error] [pid 1150:tid 1150] [client 193.202.80.128:20635] M ... show more (mod_security) mod_security (id:210350) triggered by 193.202.80.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 10:55:58.079686 2026] [security2:error] [pid 1150:tid 1150] [client 193.202.80.128:20635] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||john-bell-associates.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "john-bell-associates.com"] [uri "/guest/guest57a.htm"] [unique_id "atzG_ryfauJ_b4r2jHhHbgAAAAc"] show less

Try to access /xmlrpc.php

193.202.80.128 - - [13/Oct/2025:11:49:22 +0300] "GET /wp-content/plugins/skysa-official/readme.txt HTTP/1.1" 404 2843 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5_3; en-US) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.4 Safari/605.1.15" ... show more 193.202.80.128 - - [13/Oct/2025:11:49:22 +0300] "GET /wp-content/plugins/skysa-official/readme.txt HTTP/1.1" 404 2843 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5_3; en-US) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.4 Safari/605.1.15" ... show less

193.202.80.128 - - [11/Oct/2025:17:09:48 +0300] "POST /wp-admin/options-general.php?page=yuzo-related-post HTTP/1.1" 404 2857 "-" "Mozilla/5.0 (ZZ; Linux i686; rv:122.0) Gecko/20100101 Firefox/122.0" ...

193.202.80.128 - - [11/Oct/2025:06:26:43 +0300] "GET /cgi-bin/DownloadCfg/RouterCfm.cfg HTTP/1.1" 404 3029 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2.1 Safari/605.4.19" ...

193.202.80.128 - - [11/Oct/2025:04:12:40 +0300] "GET /wp-content/plugins/simpel-reserveren/readme.txt HTTP/1.1" 404 2825 "-" "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" ...

193.202.80.128 - - [10/Oct/2025:16:29:35 +0300] "GET /wp-content/plugins/ultimate-weather-plugin/readme.txt HTTP/1.1" 404 2820 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:123.0) Gecko/20100101 Firefox/123.0" ...

193.202.80.128 - - [10/Oct/2025:15:49:10 +0300] "POST /wp-content/plugins/sexy-contact-form/includes/fileupload/index.php HTTP/1.1" 404 2849 "-" "Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 ... show more 193.202.80.128 - - [10/Oct/2025:15:49:10 +0300] "POST /wp-content/plugins/sexy-contact-form/includes/fileupload/index.php HTTP/1.1" 404 2849 "-" "Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" ... show less

193.202.80.128 - - [10/Oct/2025:08:15:44 +0300] "GET /wp-content/plugins/sniplets/readme.txt HTTP/1.1" 404 2827 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0" ...

193.202.80.128 - - [10/Oct/2025:07:37:35 +0300] "GET /wp-content/plugins/featurific-for-wordpress/readme.txt HTTP/1.1" 404 2823 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0" 193.202.80.128 - - [10/Oct/2025:07:37:35 +030 ... show more 193.202.80.128 - - [10/Oct/2025:07:37:35 +0300] "GET /wp-content/plugins/featurific-for-wordpress/readme.txt HTTP/1.1" 404 2823 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0" 193.202.80.128 - - [10/Oct/2025:07:37:35 +0300] "GET /wp-content/plugins/adminimize/readme.txt HTTP/1.1" 404 2824 "-" "Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3" ... show less

193.202.80.128 - - [10/Oct/2025:07:04:59 +0300] "POST /wp-content/plugins/age-verification/age-verification.php HTTP/1.1" 404 2849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/128.0 (x64 de)" 193.202.80.128 - - [10/Oct/2025:0 ... show more 193.202.80.128 - - [10/Oct/2025:07:04:59 +0300] "POST /wp-content/plugins/age-verification/age-verification.php HTTP/1.1" 404 2849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/128.0 (x64 de)" 193.202.80.128 - - [10/Oct/2025:07:04:59 +0300] "GET /wp-content/plugins/sniplets/readme.txt HTTP/1.1" 404 2844 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.4.27" ... show less

GlobalProtect login attempts with user wtarrosa.

Unauthorized VPN login attempts: 1 attempts were recorded from 193.202.80.128 2025-02-01T06:40:13+01:00 vpn Access-Reject 'Customer Relationship Management (CRM) ' station: 193.202.80.128 auth-type: - realm: - nas: <redacted> called: <redacted> => a ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 193.202.80.128 2025-02-01T06:40:13+01:00 vpn Access-Reject 'Customer Relationship Management (CRM) ' station: 193.202.80.128 auth-type: - realm: - nas: <redacted> called: <redacted> => address-pool: - msg: 'Rejected: User-Name contains whitespace' show less