🇺🇸
TPI-Abuse
2026-11-11 13:17:35
UTC ·
(10 hours ago)
(mod_security) mod_security (id:210350) triggered by 213.108.0.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 08:17:30.057010 2026] [security2:error] [pid 3458:tid 3458] [client 213.108.0.65:20659] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 213.108.0.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 08:17:30.057010 2026] [security2:error] [pid 3458:tid 3458] [client 213.108.0.65:20659] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bostonlog.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bostonlog.com"] [uri "/2013-between-the-blasts-a-retired-judge-describes-the-finish-line-terror/"] [unique_id "avRq6q4mZGj7MPwPEbtjvwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 02:51:09
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 213.108.0.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 21:51:01.505377 2026] [security2:error] [pid 2630852:tid 2630860] [client 213.108.0.65:16973] ...
show more
(mod_security) mod_security (id:210350) triggered by 213.108.0.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 21:51:01.505377 2026] [security2:error] [pid 2630852:tid 2630860] [client 213.108.0.65:16973] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||fiefblondel.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "fiefblondel.com"] [uri "/Society-of-Divine-Compassion.html"] [unique_id "avKGlQ5D4_UDFNxijzJzSQAAAUQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 01:43:15
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 213.108.0.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 20:43:10.979855 2026] [security2:error] [pid 4331:tid 4331] [client 213.108.0.65:25863] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 213.108.0.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 20:43:10.979855 2026] [security2:error] [pid 4331:tid 4331] [client 213.108.0.65:25863] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.mathieu.bouville.name|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.mathieu.bouville.name"] [uri "/en/finance/articles/save-for-your-retirement-or-bankers.html"] [unique_id "avElLm-nEv5Rs-ScGuT48AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 14:50:41
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 213.108.0.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 09:50:37.579215 2026] [security2:error] [pid 23736:tid 23736] [client 213.108.0.65:62317] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 213.108.0.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 09:50:37.579215 2026] [security2:error] [pid 23736:tid 23736] [client 213.108.0.65:62317] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.desertvacationvillas.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.desertvacationvillas.com"] [uri "/de-de/privacy-policy/privacy-policy.htm"] [unique_id "avCMPRlkWqzGZUIqCGZ2sAAAAFQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-10-31 02:28:44
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇨🇭
4server
2026-09-28 23:27:41
UTC ·
(1 month ago)
[TueSep2901:27:36.4096852026][security2:error][pid3856815:tid3856834][client213.108.0.65:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"9 ...
show more
[TueSep2901:27:36.4096852026][security2:error][pid3856815:tid3856834][client213.108.0.65:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"leonitraslochi.ch\"][uri\"/xmlrpc.php\"][unique_id\"arr36D-Bo5zO4jn6iSm-EAAAAM0\"]
show less
Hacking
Web App Attack
🇩🇪
big-cloud.nl
2026-09-28 20:28:30
UTC ·
(1 month ago)
Try to access /xmlrpc.php
Web App Attack
🇩🇪
LRob
2026-09-27 21:39:39
UTC ·
(1 month ago)
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack t ...
show more
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack tools, blocked on sight. Please check the machine behind it. | method: POST | path: /xmlrpc.php | 2026-09-27 21:39 UTC
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-15 18:01:19
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 213.108.0.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 14:01:11.025020 2026] [security2:error] [pid 30690:tid 30690] [client 213.108.0.65:52579] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 213.108.0.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 14:01:11.025020 2026] [security2:error] [pid 30690:tid 30690] [client 213.108.0.65:52579] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||kennedysplace.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "kennedysplace.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqmH5wv-HUlQf8hohwBdjgAAABA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nationaleventpros.com
2026-09-15 13:14:15
UTC ·
(1 month ago)
WordPress login attempt
Brute-Force
🇨🇿
lp
2025-11-19 20:51:09
UTC ·
(11 months ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 213.108.0.65
2025-11-19T20:53:53+01:00 vpn Access-Reject 'elias.howard' station: 213.108.0.65 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<reda ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 213.108.0.65
2025-11-19T20:53:53+01:00 vpn Access-Reject 'elias.howard' station: 213.108.0.65 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
lp
2025-11-13 08:52:09
UTC ·
(11 months ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 213.108.0.65
2025-11-13T09:31:30+01:00 vpn Access-Reject 'joseph.sanders' station: 213.108.0.65 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<re ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 213.108.0.65
2025-11-13T09:31:30+01:00 vpn Access-Reject 'joseph.sanders' station: 213.108.0.65 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
2025-05-17 16:54:32
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-05-14 11:07:30
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-05-11 08:23:24
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
