🇺🇸
TPI-Abuse
2026-10-26 16:31:56
(4 hours ago)
(mod_security) mod_security (id:210350) triggered by 193.202.81.117 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 193.202.81.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 12:31:51.166496 2026] [security2:error] [pid 31440:tid 31440] [client 193.202.81.117:22029] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ohwaitiforgot.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ohwaitiforgot.com"] [uri "/2014/03/27/2014-book-19-the-inverted-world/"] [unique_id "at-Ad0zgR3HIuIMAopp4BQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 13:59:51
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 193.202.81.117 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 193.202.81.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:59:46.544809 2026] [security2:error] [pid 758:tid 758] [client 193.202.81.117:32607] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.dunbartonucc.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.dunbartonucc.org"] [uri "/dcc-boards/deacons/membership/"] [unique_id "atDcUurGiD2vWKwAjZ8lngAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-27 21:38:24
(4 weeks ago)
This address sends abusive requests to WordPress sites we host: user enumeration through the REST AP ...
show more
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack tools, blocked on sight. Please check the machine behind it. | method: POST | path: /xmlrpc.php | 2026-09-27 21:38 UTC
show less
Web App Attack
Hacking
🇩🇪
stinpriza
2026-09-25 21:15:22
(1 month ago)
Web App Attack
Web App Attack
🇨🇿
Countryman
2026-09-15 00:10:01
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-13 00:10:01
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-10 06:22:21
(1 month ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 193.202.81.117
2026-09-10T07:52:03+02 ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 193.202.81.117
2026-09-10T07:52:03+02:00 vpn Access-Reject 'kerem' station: 193.202.81.117 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-07 00:17:10
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 193.202.81.117 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 193.202.81.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 20:17:05.180543 2026] [security2:error] [pid 31648:tid 31648] [client 193.202.81.117:49957] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||callalbany.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "callalbany.com"] [uri "/"] [unique_id "akxFgXkItwSpYFm6BrTelAAAAAY"], referer: https://www.facebook.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-28 18:09:12
(4 months ago)
SQL injection, multiple attempts.
SQL Injection
🇺🇸
TPI-Abuse
2026-05-04 00:18:03
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 193.202.81.117 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 193.202.81.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 03 20:17:55.635222 2026] [security2:error] [pid 29863:tid 29863] [client 193.202.81.117:40083] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gemexpressions.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gemexpressions.com"] [uri "/wp-json/wp/v2/users"] [unique_id "affls8cNxCdeshgI-fGUXgAAAAc"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-04-20 04:08:38
(6 months ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
LRob
2026-04-17 13:15:03
(6 months ago)
WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail
Brute-Force
Web App Attack
🇲🇹
Malta
2026-02-17 22:36:01
(8 months ago)
193.202.81.117 - - [17/Feb/2026:23:36:01 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows ...
show more
193.202.81.117 - - [17/Feb/2026:23:36:01 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
show less
Hacking
Web App Attack
VPN IP
2026-01-23 15:43:14
(9 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-01-22 22:07:11
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 193.202.81.117 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 193.202.81.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 17:07:05.026259 2026] [security2:error] [pid 1535199:tid 1535199] [client 193.202.81.117:34673] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||billwegener.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "billwegener.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aXKfiQHVI4Yq87UBGlG5mgAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
