🇺🇸
TPI-Abuse
2026-11-15 16:57:11
UTC ·
(13 minutes ago)
(mod_security) mod_security (id:210350) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 11:57:05.698977 2026] [security2:error] [pid 12727:tid 12727] [client 212.18.127.151:36585] ...
show more
(mod_security) mod_security (id:210350) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 11:57:05.698977 2026] [security2:error] [pid 12727:tid 12727] [client 212.18.127.151:36585] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2016/02/06/higher-taxes-for-some-have-to-be-on-the-table/"] [unique_id "avnkYcgH__bILG8asIyplwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-13 04:12:24
UTC ·
(2 days ago)
WordPress attack-tool calls | method: POST | path: /xmlrpc.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | src_port: 34883
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-03 08:39:57
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:39:53.234158 2026] [security2:error] [pid 2719134:tid 2719222] [client 212.18.127.151:36 ...
show more
(mod_security) mod_security (id:210350) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:39:53.234158 2026] [security2:error] [pid 2719134:tid 2719222] [client 212.18.127.151:36337] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bullfrogspond.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bullfrogspond.com"] [uri "/whitburn/2000wye.htm"] [unique_id "aumd2aI76sjz9DCDJ74pHAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-03 00:33:03
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 14:32:15
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 10:32:06.045656 2026] [security2:error] [pid 16219:tid 16219] [client 212.18.127.151:60879] ...
show more
(mod_security) mod_security (id:210350) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 10:32:06.045656 2026] [security2:error] [pid 16219:tid 16219] [client 212.18.127.151:60879] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bassboatmagazine.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bassboatmagazine.com"] [uri "/archive/index.php/t-1684.html"] [unique_id "auNY5gbRkvhirboNLmOTcAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-25 04:00:14
UTC ·
(4 months ago)
(mod_security) mod_security triggered on hostname [redacted] 212.18.127.151 (US/United States/-)
SQL Injection
🇩🇪
london2038.com
2026-06-10 20:41:58
UTC ·
(5 months ago)
Detected by WP fail2ban
2026-06-10T22:41:57.585351+02:00 wordpress: Authentication attempt from 212.18.127.151
Brute-Force
Web App Attack
🇩🇪
FeG Deutschland
2026-05-21 22:57:36
UTC ·
(5 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-05-21 21:57:03
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 17:56:58.682458 2026] [security2:error] [pid 26770:tid 26808] [client 212.18.127.151:38681] ...
show more
(mod_security) mod_security (id:210492) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 17:56:58.682458 2026] [security2:error] [pid 26770:tid 26808] [client 212.18.127.151:38681] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dwcmachining.com"] [uri "/wp-config.php.save"] [unique_id "ag9_qmhuK-vBXXcU3XFh2gAAAQ4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 18:16:23
UTC ·
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 14:16:15.811170 2026] [security2:error] [pid 28866:tid 28866] [client 212.18.127.151:15233] ...
show more
(mod_security) mod_security (id:210730) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 14:16:15.811170 2026] [security2:error] [pid 28866:tid 28866] [client 212.18.127.151:15233] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.puckerbikinis.puckerbikini.com|F|2"] [data ".inc"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.puckerbikinis.puckerbikini.com"] [uri "/wp-config.inc"] [unique_id "ag36b4vLwCR7yA713tJgUQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 16:17:57
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 12:17:51.485472 2026] [security2:error] [pid 22686:tid 22686] [client 212.18.127.151:16385] ...
show more
(mod_security) mod_security (id:210492) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 12:17:51.485472 2026] [security2:error] [pid 22686:tid 22686] [client 212.18.127.151:16385] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.fuji.cloudex.link"] [uri "/wp-config.php.old"] [unique_id "ag3er31p48NJgulK5RP0RwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 03:11:52
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 23:11:47.177390 2026] [security2:error] [pid 10089:tid 10089] [client 212.18.127.151:52729] ...
show more
(mod_security) mod_security (id:210492) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 23:11:47.177390 2026] [security2:error] [pid 10089:tid 10089] [client 212.18.127.151:52729] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "proyectando.com"] [uri "/wp-config.php.orig"] [unique_id "ag0mcwnJSOMCKEHa3XGlfQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-05-17 10:04:43
UTC ·
(5 months ago)
COMODO WAF: URL file extension is restricted by policy. Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. (210730-143)
Hacking
🇬🇧
Oakley
2026-05-02 11:36:56
UTC ·
(6 months ago)
(mod_security) mod_security (id:949110) triggered by 212.18.127.151 (US/United States/-): 5 in the last 900 secs
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-04-11 23:28:28
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 19:28:21.199404 2026] [security2:error] [pid 1467518:tid 1467518] [client 212.18.127.151:25 ...
show more
(mod_security) mod_security (id:210350) triggered by 212.18.127.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 19:28:21.199404 2026] [security2:error] [pid 1467518:tid 1467518] [client 212.18.127.151:25295] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||andrsn.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "andrsn.com"] [uri "/"] [unique_id "adrZFVSceOTLbEi3arF0EAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
