πΊπΈ
TPI-Abuse
2026-10-16 14:43:11
(12 hours ago)
(mod_security) mod_security (id:225170) triggered by 45.178.1.227 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 45.178.1.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 10:43:05.224601 2026] [security2:error] [pid 16013:tid 16013] [client 45.178.1.227:44052] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||terfgunclub.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "terfgunclub.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atI3-XKL5PRM64O5veDSRgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
π©πͺ
neckaralb-admin.de
2026-10-16 13:25:45
(13 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
πΊπΈ
TPI-Abuse
2026-10-14 22:19:38
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 45.178.1.227 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 45.178.1.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 18:19:34.524374 2026] [security2:error] [pid 21213:tid 21213] [client 45.178.1.227:9214] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jaragoodrich.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jaragoodrich.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "as__9lT4YBbnscJd8gk40AAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
πΈπͺ
vaia.cloud
2026-10-14 16:10:03
(2 days ago)
crowdsecurity/http-cve-probing
Brute-Force
Web App Attack
π©πͺ
FeG Deutschland
2026-10-14 14:49:35
(2 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
π«π·
LRob
2026-10-13 21:11:43
(3 days ago)
Not following 301 redirects β wasted requests | method: GET | path: /wp-login.php | ua: Mozilla/5.0 ...
show more
Not following 301 redirects β wasted requests | method: GET | path: /wp-login.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
show less
Bad Web Bot
πΊπΈ
TPI-Abuse
2026-10-10 17:04:38
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 45.178.1.227 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210350) triggered by 45.178.1.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 13:04:31.910325 2026] [security2:error] [pid 22038:tid 22038] [client 45.178.1.227:49639] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||giganticmediallc.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "giganticmediallc.com"] [uri "/"] [unique_id "aspwH2DtEy4YNSJZM071YwAAAF4"], referer: https://list.show/link-profile/wateraid.org/dc4a26d6a37dcc52ec8c698282b989d8
show less
Brute-Force
Bad Web Bot
Web App Attack
π«π·
LoneRider
2026-10-08 13:27:48
(1 week ago)
45.178.1.227 - - [08/Oct/2026:15:27:46 +0200] "POST /wp/wp-login.php HTTP/1.1" 200 8047 "https://ned ...
show more
45.178.1.227 - - [08/Oct/2026:15:27:46 +0200] "POST /wp/wp-login.php HTTP/1.1" 200 8047 "https://nedcann.com/wp/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
45.178.1.227 - - [08/Oct/2026:15:27:46 +0200] "POST /wp/wp-login.php HTTP/1.1" 200 8047 "https://nedcann.com/wp/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
45.178.1.227 - - [08/Oct/2026:15:27:47 +0200] "POST /wp/wp-login.php HTTP/1.1" 200 8047 "https://nedcann.com/wp/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
...
show less
Web App Attack
πΊπΈ
TPI-Abuse
2026-10-06 11:47:39
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 45.178.1.227 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 45.178.1.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 07:47:27.031286 2026] [security2:error] [pid 1136:tid 1136] [client 45.178.1.227:39112] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||darkcodeproductions.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "darkcodeproductions.com"] [uri "/pgsql/db-backup.sql"] [unique_id "asTfz0fccyd2nnZ1DcInAQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
π¨πΏ
Countryman
2026-10-01 00:10:02
(2 weeks ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
π¨πΏ
lp
2026-09-29 04:55:40
(2 weeks ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 45.178.1.227
2026-09-29T05:56:33+02:0 ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 45.178.1.227
2026-09-29T05:56:33+02:00 vpn Access-Reject 'xkasn03' station: 45.178.1.227 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
πΊπΈ
TPI-Abuse
2026-09-22 04:10:23
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 45.178.1.227 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210350) triggered by 45.178.1.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 00:10:15.786858 2026] [security2:error] [pid 30366:tid 30366] [client 45.178.1.227:54285] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||silvermoonherbals.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "silvermoonherbals.com"] [uri "/"] [unique_id "arH_p6uizudsxPIFh83LTAAAAI8"], referer: https://silvermoonherbals.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
πΊπΈ
ι¬Όε½±233
2026-09-21 20:29:22
(3 weeks ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ...
show more
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
show less
Bad Web Bot
πΊπΈ
TPI-Abuse
2026-09-16 20:07:13
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 45.178.1.227 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210350) triggered by 45.178.1.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 16:07:07.157695 2026] [security2:error] [pid 2110:tid 2110] [client 45.178.1.227:43610] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||gildemello.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "gildemello.com"] [uri "/cgi-bin"] [unique_id "aqr265GDYnuXSQE_ZH93VQAAAAU"], referer: https://gildemello.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
πΊπΈ
ι¬Όε½±233
2026-08-30 16:15:20
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ...
show more
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
show less
Bad Web Bot