77.220.192.191

(mod_security) mod_security (id:210350) triggered by 77.220.192.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 04:03:24.599813 2026] [security2:error] [pid 11718:tid 11718] [client 77.220.192.191:41145] ... show more (mod_security) mod_security (id:210350) triggered by 77.220.192.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 04:03:24.599813 2026] [security2:error] [pid 11718:tid 11718] [client 77.220.192.191:41145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aes-nihil.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aes-nihil.com"] [uri "/index2.html"] [unique_id "auRPTIY5gJwfnZlJI2LIwgAAAAY"] show less

(mod_security) mod_security (id:210350) triggered by 77.220.192.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 14:35:40.275239 2026] [security2:error] [pid 26989:tid 26989] [client 77.220.192.191:23571] ... show more (mod_security) mod_security (id:210350) triggered by 77.220.192.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 14:35:40.275239 2026] [security2:error] [pid 26989:tid 26989] [client 77.220.192.191:23571] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||batfry.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "batfry.com"] [uri "/batfry-franchise/"] [unique_id "at5L_OcfEAK1o-S1plVp7gAAAAo"] show less

(mod_security) mod_security (id:210350) triggered by 77.220.192.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 19:31:08.250437 2026] [security2:error] [pid 31867:tid 31867] [client 77.220.192.191:47207] ... show more (mod_security) mod_security (id:210350) triggered by 77.220.192.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 19:31:08.250437 2026] [security2:error] [pid 31867:tid 31867] [client 77.220.192.191:47207] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jmichaelpope.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jmichaelpope.com"] [uri "/musical-instruments/voice-lessons/"] [unique_id "atqcvOGksHTvl-St_rODRQAAAAM"] show less

Jarvis auto-ban: CF honeypot path /wp-login.php (1× on saec.me)

Scanning for installed WordPress and vulnerabilities 77.220.192.191 [23/May/2026:15:29:26] "GET /wp-login.php HTTP/1.1"

Accessed trap at '/wp-login.php'

block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8

WordPress login attempt

77.220.192.191 - - [03/Mar/2026:14:19:14 -0700] "POST /wp-login.php HTTP/1.1" 200 2354 "https://dooce.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" ...

Web App Attack

2025-08-28 @ 18:37:44 (CET) ~ Blocked for trying to access: /erker/wp/wp-login.php

“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ... show more “BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user” show less

“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ... show more “BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user “ show less

(mod_security) mod_security (id:210492) triggered by 77.220.192.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 16 09:05:40.313654 2025] [security2:error] [pid 30868:tid 30868] [client 77.220.192.191:17441] ... show more (mod_security) mod_security (id:210492) triggered by 77.220.192.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 16 09:05:40.313654 2025] [security2:error] [pid 30868:tid 30868] [client 77.220.192.191:17441] [client 77.220.192.191] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cain2016.org"] [uri "/.env"] [unique_id "Z7HwtBhLBsCvvJQULK74YwAAAAU"], referer: https://tasamm.com/about/ccc8.html show less