🇺🇸
TPI-Abuse
2026-11-06 23:08:43
UTC ·
(3 hours ago)
(mod_security) mod_security (id:210350) triggered by 45.10.167.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:08:26.225518 2026] [security2:error] [pid 2487:tid 2487] [client 45.10.167.83:19273] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 45.10.167.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:08:26.225518 2026] [security2:error] [pid 2487:tid 2487] [client 45.10.167.83:19273] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bostonlog.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bostonlog.com"] [uri "/three-bostons-shane-mundy-april-2010/"] [unique_id "au5d6vVmYNrqUGqkmsvzowAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 01:39:34
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 45.10.167.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 20:39:18.177810 2026] [security2:error] [pid 30540:tid 30540] [client 45.10.167.83:14789] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 45.10.167.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 20:39:18.177810 2026] [security2:error] [pid 30540:tid 30540] [client 45.10.167.83:14789] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ruthbalser.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ruthbalser.org"] [uri "/news/boston-globe-full-disclosure-on-deaths-at-nursing-homes-will-take-time-state-officials-say/"] [unique_id "auk7RjFZWmo6dhZSHohVAAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 05:33:20
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 45.10.167.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 01:33:04.354872 2026] [security2:error] [pid 25806:tid 25806] [client 45.10.167.83:30983] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 45.10.167.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 01:33:04.354872 2026] [security2:error] [pid 25806:tid 25806] [client 45.10.167.83:30983] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cgsaviation.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cgsaviation.com"] [uri "/hawksport.htm"] [unique_id "atb9EERYI1yG3al5808w1QAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-10-13 22:44:54
UTC ·
(3 weeks ago)
Try to access /xmlrpc.php
Web App Attack
2026-07-07 13:54:57
UTC ·
(3 months ago)
[osotir.org] httpd-xmlrpc-post: sites=www.synathlountes.agonistes.gr; logs=/var/log/httpd/domains/agonistes.gr.synathlountes.log; samples=/xmlrpc.php
Brute-Force
Web App Attack
2026-07-01 05:18:20
UTC ·
(4 months ago)
2026/07/01 07:18:16 [error] 13969#13969: *18751 access forbidden by rule, client: 45.10.167.83, server: sahpa.co.za, request: "POST /xmlrpc.php HTTP/1.1", host: "sahpa.co.za"
2026/07/01 07:18:18 [error] 13969#13969: *18752 access forbidden by rule, c ...
show more
2026/07/01 07:18:16 [error] 13969#13969: *18751 access forbidden by rule, client: 45.10.167.83, server: sahpa.co.za, request: "POST /xmlrpc.php HTTP/1.1", host: "sahpa.co.za"
2026/07/01 07:18:18 [error] 13969#13969: *18752 access forbidden by rule, client: 45.10.167.83, server: sahpa.co.za, request: "POST /xmlrpc.php HTTP/1.1", host: "sahpa.co.za"
2026/07/01 07:18:20 [error] 13969#13969: *18753 access forbidden by rule, client: 45.10.167.83, server: sahpa.co.za, request: "POST /xmlrpc.php HTTP/1.1", host: "sahpa.co.za"
...
show less
Hacking
Web App Attack
🇧🇪
Saec
2026-06-29 11:00:35
UTC ·
(4 months ago)
Jarvis auto-ban: CF honeypot path /wp-login.php (1× on saec.me)
Port Scan
Web App Attack
2026-06-21 22:09:28
UTC ·
(4 months ago)
[osotir.org] httpd-login-spray-site: sites=agonistes.gr.synathlountes; logs=/var/log/httpd/domains/agonistes.gr.synathlountes.log; samples=site_wide=true | distinct_ips=11 | /wp-login.php
Hacking
Web App Attack
2025-12-06 19:15:00
UTC ·
(11 months ago)
wordpress-trap
Web App Attack
2025-05-29 09:52:18
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-04-17 10:00:00
UTC ·
(1 year ago)
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ...
show more
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user”
show less
Hacking
Brute-Force
Web App Attack
2025-04-17 10:00:00
UTC ·
(1 year ago)
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ...
show more
“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user “
show less
Hacking
Brute-Force
Web App Attack
2025-04-12 00:01:57
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇪🇸
10dencehispahard SL
2025-04-10 06:33:12
UTC ·
(1 year ago)
WP probing for vulnerabilities
Hacking
Exploited Host
🇺🇸
TPI-Abuse
2025-02-27 22:50:00
UTC ·
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 45.10.167.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 27 17:49:44.803054 2025] [security2:error] [pid 2749195:tid 2749195] [client 45.10.167.83:32921] ...
show more
(mod_security) mod_security (id:210492) triggered by 45.10.167.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 27 17:49:44.803054 2025] [security2:error] [pid 2749195:tid 2749195] [client 45.10.167.83:32921] [client 45.10.167.83] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fiveoceansconsulting.com"] [uri "/.env"] [unique_id "Z8DsCD5kFqjS72RHMvytIAAAAAQ"], referer: https://tasamm.com/about/fff25.html
show less
Brute-Force
Bad Web Bot
Web App Attack
