🇺🇸
TPI-Abuse
2026-11-10 14:02:34
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:02:18.424327 2026] [security2:error] [pid 9109:tid 9109] [client 5.181.170.21:38211] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:02:18.424327 2026] [security2:error] [pid 9109:tid 9109] [client 5.181.170.21:38211] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.fgrotary.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fgrotary.org"] [uri "/2015/"] [unique_id "avMj6pBxeE9vXkQKVcAkQAAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 05:48:11
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 00:47:54.892799 2026] [security2:error] [pid 2362:tid 2362] [client 5.181.170.21:33659] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 00:47:54.892799 2026] [security2:error] [pid 2362:tid 2362] [client 5.181.170.21:33659] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||sabbathseminars.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "sabbathseminars.net"] [uri "/Past-Presentations/Adventist-History-in-a-New-Key/adventist-history-in-a-new-key.html"] [unique_id "aul1ihfygmiBytZTkC8wEwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 02:06:01
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 22:05:46.739168 2026] [security2:error] [pid 3361:tid 3366] [client 5.181.170.21:45993] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 22:05:46.739168 2026] [security2:error] [pid 3361:tid 3366] [client 5.181.170.21:45993] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||newtrendmag.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "newtrendmag.org"] [uri "/ntma1166.htm"] [unique_id "auVM-uphLvobjj_nf4LexAAAAEM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 02:19:39
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 22:19:24.579623 2026] [security2:error] [pid 6565:tid 6565] [client 5.181.170.21:62753] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 22:19:24.579623 2026] [security2:error] [pid 6565:tid 6565] [client 5.181.170.21:62753] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.musicrolls.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.musicrolls.com"] [uri "/covering-1.html"] [unique_id "auP-rO22mCnZfF4TGNXwEAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 14:52:18
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 10:52:01.675129 2026] [security2:error] [pid 11244:tid 11244] [client 5.181.170.21:47437] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 10:52:01.675129 2026] [security2:error] [pid 11244:tid 11244] [client 5.181.170.21:47437] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||firstlovedevotions.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "firstlovedevotions.com"] [uri "/6E/6_15_evening.htm"] [unique_id "auNdkW9WA6b5-m-XLn-LIQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 02:33:17
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 22:33:00.744312 2026] [security2:error] [pid 27359:tid 27359] [client 5.181.170.21:12517] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 22:33:00.744312 2026] [security2:error] [pid 27359:tid 27359] [client 5.181.170.21:12517] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||citadeltitle.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "citadeltitle.com"] [uri "/shortsales.html"] [unique_id "auFe3OICNcsqBYxJyFQsrAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-31 09:48:34
UTC ·
(3 months ago)
Apache credential probing in 2026-07-31T09:33:34Z..2026-07-31T09:48:34Z: 44 hits on url=/wp-login.php, 2 hits on url=/xmlrpc.php.
Web App Attack
🇨🇦
DRI
2026-07-31 05:21:47
UTC ·
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇩🇪
Ba-Yu
2026-07-30 01:24:03
UTC ·
(3 months ago)
WordPress bruteforce
Web Spam
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-07-26 07:34:49
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 03:34:35.259139 2026] [security2:error] [pid 2435425:tid 2435425] [client 5.181.170.21:26659] ...
show more
(mod_security) mod_security (id:225170) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 03:34:35.259139 2026] [security2:error] [pid 2435425:tid 2435425] [client 5.181.170.21:26659] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||iahksa.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "iahksa.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amW4i1EZhPXpmEW2b18tlwAAAAU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
DRI
2026-07-19 03:51:21
UTC ·
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
2026-05-04 02:50:00
UTC ·
(6 months ago)
FPROCO WEBEXPLOIT 5.181.170.21 (5.181.170.21)
Web App Attack
🇺🇸
nationaleventpros.com
2026-04-18 04:16:17
UTC ·
(6 months ago)
WordPress login attempt
Brute-Force
🇺🇸
TPI-Abuse
2026-04-13 23:27:48
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 13 19:27:32.032842 2026] [security2:error] [pid 2968579:tid 2968579] [client 5.181.170.21:15673] ...
show more
(mod_security) mod_security (id:225170) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 13 19:27:32.032842 2026] [security2:error] [pid 2968579:tid 2968579] [client 5.181.170.21:15673] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||weyoungrenovations.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "weyoungrenovations.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad175OgUwSWmjFzZ_SJrmQAAAAA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-05 20:48:29
UTC ·
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 05 16:48:14.591673 2025] [security2:error] [pid 32253:tid 32253] [client 5.181.170.21:22783] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 5.181.170.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 05 16:48:14.591673 2025] [security2:error] [pid 32253:tid 32253] [client 5.181.170.21:22783] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||proyectando.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "proyectando.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aOLZjlYoT5aNYXPLLBN_ewAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
