45.135.2.174

(mod_security) mod_security (id:210350) triggered by 45.135.2.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 05:33:09.120375 2026] [security2:error] [pid 26527:tid 26527] [client 45.135.2.174:11731] Mod ... show more (mod_security) mod_security (id:210350) triggered by 45.135.2.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 05:33:09.120375 2026] [security2:error] [pid 26527:tid 26527] [client 45.135.2.174:11731] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aaabft.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aaabft.com"] [uri "/index.html"] [unique_id "at8eVYZzrofO9En3mbT7zwAAAAY"] show less

Web App Attack

[SatAug0115:26:48.7335272026][security2:error][pid1564874:tid1564940][client45.135.2.174:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"9 ... show more [SatAug0115:26:48.7335272026][security2:error][pid1564874:tid1564940][client45.135.2.174:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"alessandrolucchini.ch\"][uri\"/xmlrpc.php\"][unique_id\"am30GOx41xcnL0noih91-QAAAIQ\"] show less

CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc | req: ["/xmlrpc.php"] | UA: ["curl/8.6.0","Wget/1.21.4","curl/7.88.1"]

Multiple WAF Violations

Attempted WordPress login: 45.135.2.174 - - [22/May/2026:13:28:49 +0100] "GET /wp-login.php HTTP/1.1" 200 234 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"

F2B - Malicious activity detected. URL Probing. -8ff06ede-

Fail2Ban banned 45.135.2.174 for security violations in jail wp-armour. Log: 2026/05/21 20:52:38 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 45.135.2.174 | Target: wplogin" , client: 45.135.2.174, server: [REDACTED], request: "P ... show more Fail2Ban banned 45.135.2.174 for security violations in jail wp-armour. Log: 2026/05/21 20:52:38 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 45.135.2.174 | Target: wplogin" , client: 45.135.2.174, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php" ... show less

block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8

45.135.2.174 - - [18/May/2026:16:11:46 +0200] "GET /wp-login.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" ...

WP bruteforce attack

(mod_security) mod_security (id:210730) triggered by 45.135.2.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 17:39:37.026766 2026] [security2:error] [pid 2018:tid 2018] [client 45.135.2.174:31697] ModSe ... show more (mod_security) mod_security (id:210730) triggered by 45.135.2.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 17:39:37.026766 2026] [security2:error] [pid 2018:tid 2018] [client 45.135.2.174:31697] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.bidsonlineauctions.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bidsonlineauctions.com"] [uri "/s3cmd.ini"] [unique_id "afJ6mQBz9xuqXTr6p3wUEgAAAAw"] show less

(mod_security) mod_security (id:210730) triggered by 45.135.2.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 15:38:18.560693 2026] [security2:error] [pid 24707:tid 24707] [client 45.135.2.174:14799] Mod ... show more (mod_security) mod_security (id:210730) triggered by 45.135.2.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 15:38:18.560693 2026] [security2:error] [pid 24707:tid 24707] [client 45.135.2.174:14799] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.carmel.xyz|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.carmel.xyz"] [uri "/s3cmd.ini"] [unique_id "ae-7KlZiRJA5KMYi1w3ECAAAAAk"] show less

(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 45.135.2.174 (US/United States/-): 1 in the last 3600 secs (0-195)

(mod_security) mod_security (id:210730) triggered by 45.135.2.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 11:36:48.410842 2026] [security2:error] [pid 20996:tid 20996] [client 45.135.2.174:62569] Mod ... show more (mod_security) mod_security (id:210730) triggered by 45.135.2.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 11:36:48.410842 2026] [security2:error] [pid 20996:tid 20996] [client 45.135.2.174:62569] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.beta.flavornet.org|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.beta.flavornet.org"] [uri "/s3cmd.ini"] [unique_id "ae4xEASv38qgVQ43brfEKgAAAAg"] show less