🇺🇸
Zandro
2026-11-12 04:00:14
UTC ·
(4 hours ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-09 12:54:11
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 07:54:07.628096 2026] [security2:error] [pid 30355:tid 30355] [client 45.135.3.229:37207] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 07:54:07.628096 2026] [security2:error] [pid 30355:tid 30355] [client 45.135.3.229:37207] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||thepartyblock.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "thepartyblock.com"] [uri "/floralbouquet.htm"] [unique_id "avHCbycjfHIoyERnQG2akQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 15:14:08
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 10:13:53.098815 2026] [security2:error] [pid 1483739:tid 1483822] [client 45.135.3.229:9445] ...
show more
(mod_security) mod_security (id:210350) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 10:13:53.098815 2026] [security2:error] [pid 1483739:tid 1483822] [client 45.135.3.229:9445] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.pflagabq.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.pflagabq.org"] [uri "/about.html"] [unique_id "au3usQU5v2SGVnsUbnWqiQAAAJI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 08:46:34
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:46:18.940011 2026] [security2:error] [pid 16452:tid 16452] [client 45.135.3.229:10461] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:46:18.940011 2026] [security2:error] [pid 16452:tid 16452] [client 45.135.3.229:10461] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||vitality-web.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "vitality-web.com"] [uri "/backstore/chiropractic.htm"] [unique_id "aumfWohAW8Y2v4GSEC0-4gAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 09:20:48
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 04:20:34.080132 2026] [security2:error] [pid 6335:tid 6335] [client 45.135.3.229:38099] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 04:20:34.080132 2026] [security2:error] [pid 6335:tid 6335] [client 45.135.3.229:38099] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.getlawforms.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.getlawforms.com"] [uri "/assignment-of-lease-by-lessee-with-consent-of-lessor.htm"] [unique_id "auhV4m1KcSvnUYXvdAHqwgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 15:14:19
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 10:14:03.669292 2026] [security2:error] [pid 9705:tid 9705] [client 45.135.3.229:16729] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 10:14:03.669292 2026] [security2:error] [pid 9705:tid 9705] [client 45.135.3.229:16729] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||painting-with-numbers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "painting-with-numbers.com"] [uri "/blog/"] [unique_id "audXO4vfGJfJKOBpVN7b0gAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-21 21:03:53
UTC ·
(3 weeks ago)
Bad Web Bot
🇩🇪
Ilop
2026-08-09 00:03:43
UTC ·
(3 months ago)
[hp-100] 9 unsolicited packets to honeypot ports 9000 (OCI DShield sensor)
Port Scan
🇺🇸
TPI-Abuse
2026-05-29 12:48:41
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 08:48:34.198570 2026] [security2:error] [pid 11023:tid 11023] [client 45.135.3.229:12363] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 08:48:34.198570 2026] [security2:error] [pid 11023:tid 11023] [client 45.135.3.229:12363] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||russellzone.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "russellzone.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahmLIscHd_ps81EAt9obxQAAAAo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
sshtmp
2026-05-21 17:07:34
UTC ·
(5 months ago)
[AbuseIPDB auto-report]
Attack: WordPress XML-RPC brute-force
Hits: 1 | First: 2026-05-21T19:07:34+02:00 | Last: 2026-05-21T19:07:34+02:00
Samples: POST /xmlrpc.php [200]
Brute-Force
Web App Attack
🇺🇸
octageeks.com
2026-05-09 04:06:05
UTC ·
(6 months ago)
Wordpress malicious attack:[octaxmlrpc]
Web App Attack
🇮🇹
VHosting
2026-03-26 20:22:00
UTC ·
(7 months ago)
Detected attack and reported by a human
Brute-Force
Web App Attack
SSH
DDoS Attack
Exploited Host
Bad Web Bot
🇺🇸
TPI-Abuse
2026-01-22 19:23:22
UTC ·
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 14:23:14.799761 2026] [security2:error] [pid 19888:tid 19888] [client 45.135.3.229:55749] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 45.135.3.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 14:23:14.799761 2026] [security2:error] [pid 19888:tid 19888] [client 45.135.3.229:55749] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||greatchristianadventure.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "greatchristianadventure.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXJ5ItWJBOQpUENV22DZYQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
alph44
2026-01-03 02:21:44
UTC ·
(10 months ago)
WordPress attack detected by fail2ban: 3 failed attempts
Web App Attack
🇮🇹
mgarofano80
2025-11-10 02:33:29
UTC ·
(1 year ago)
Brute-Force
Web App Attack
