🇺🇸
TPI-Abuse
2026-11-10 15:44:39
UTC ·
(9 hours ago)
(mod_security) mod_security (id:210350) triggered by 77.81.65.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:44:33.391991 2026] [security2:error] [pid 6282:tid 6282] [client 77.81.65.217:58941] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 77.81.65.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:44:33.391991 2026] [security2:error] [pid 6282:tid 6282] [client 77.81.65.217:58941] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.fundingangelinvestors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fundingangelinvestors.com"] [uri "/tag/make-money-on-facebook/"] [unique_id "avM74bhcmfp-a4kaDVBC7wAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 19:33:01
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 77.81.65.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:32:54.426063 2026] [security2:error] [pid 22574:tid 22574] [client 77.81.65.217:55697] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 77.81.65.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:32:54.426063 2026] [security2:error] [pid 22574:tid 22574] [client 77.81.65.217:55697] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cherith-bible-inst.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cherith-bible-inst.org"] [uri "/Info20.html"] [unique_id "auJN5onfFiF8xstRZt_VxQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 21:43:43
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 77.81.65.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 17:43:34.542975 2026] [security2:error] [pid 526:tid 526] [client 77.81.65.217:24785] ModSecu ...
show more
(mod_security) mod_security (id:210350) triggered by 77.81.65.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 17:43:34.542975 2026] [security2:error] [pid 526:tid 526] [client 77.81.65.217:24785] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.virginians.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.virginians.com"] [uri "/topics/856.htm"] [unique_id "atkyBjGQdeKwYHpcoeHBAAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
www.winos.me
2026-08-31 12:05:05
UTC ·
(2 months ago)
Scanning for sensitive files/paths: /wp-login.php
Hacking
Web App Attack
🇩🇪
4server
2026-08-27 13:02:13
UTC ·
(2 months ago)
[ThuAug2715:02:06.2908742026][security2:error][pid1216477:tid1216546][client77.81.65.217:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"9 ...
show more
[ThuAug2715:02:06.2908742026][security2:error][pid1216477:tid1216546][client77.81.65.217:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"feldenkraistherapy.ch\"][uri\"/xmlrpc.php\"][unique_id\"apA1TsjYvGOJv6i9549pXgAAAQA\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 02:09:29
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 77.81.65.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 22:09:21.654069 2026] [security2:error] [pid 24793:tid 24793] [client 77.81.65.217:40531] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 77.81.65.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 22:09:21.654069 2026] [security2:error] [pid 24793:tid 24793] [client 77.81.65.217:40531] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||donnysimonton.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "donnysimonton.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acss0bjfMU6HE78vbDoUsAAAAAo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-14 13:13:00
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 77.81.65.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 14 09:12:56.002649 2026] [security2:error] [pid 1766:tid 1856] [client 77.81.65.217:65323] ModSe ...
show more
(mod_security) mod_security (id:225170) triggered by 77.81.65.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 14 09:12:56.002649 2026] [security2:error] [pid 1766:tid 1856] [client 77.81.65.217:65323] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||driftwoodblue.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "driftwoodblue.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abVe11kJRL4k83y4xVRqkgAAAcY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇳
liveaspankaj
2026-02-26 22:46:45
UTC ·
(8 months ago)
DDoS attack: 155 requests in 5m (GET / or repair.php).
DDoS Attack
2026-01-23 15:29:33
UTC ·
(9 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇷🇺
sms.ru
2024-09-30 17:20:08
UTC ·
(2 years ago)
SMS pumping attack from foreign country
DDoS Attack
🇩🇪
NxtGenIT
2024-05-30 03:49:14
UTC ·
(2 years ago)
77.81.65.217 has been observed attacking Port 1812. Observed Threat: RADIUS Login Brute Force Attempt
Brute-Force
🇩🇪
NxtGenIT
2024-05-27 22:37:42
UTC ·
(2 years ago)
77.81.65.217 has been observed attacking Port 1812. Observed Threat: RADIUS Login Brute Force Attempt
Brute-Force
🇩🇪
NxtGenIT
2024-05-23 21:25:51
UTC ·
(2 years ago)
77.81.65.217 has been observed attacking Port 1812. Observed Threat: RADIUS Login Brute Force Attempt
Brute-Force
🇬🇧
Buster
2024-01-22 17:10:00
UTC ·
(2 years ago)
Repeated script kiddie distributed attack attempts on multiple sites from Perm Blocked Extremely High Risk ASN and country:: Attacks on 103.44.55.242, 104.148.85.135, 104.164.122.61, 104.164.192.38, 104.253.171.13, 105.110.29.161, 107.187.100.52, 136 ...
show more
Repeated script kiddie distributed attack attempts on multiple sites from Perm Blocked Extremely High Risk ASN and country:: Attacks on 103.44.55.242, 104.148.85.135, 104.164.122.61, 104.164.192.38, 104.253.171.13, 105.110.29.161, 107.187.100.52, 136.0.116.62, 136.185.161.226, 138.229.104.102, 139.180.3.78, 144.217.101.253, 144.217.251.253, 147.53.122.27, 154.202.89.129, 154.83.45.4, 154.83.46.59, 156.204.214.211, 161.0.13.179, 161.0.8.105, 162.213.72.167, 172.96.83.111, 175.107.233.94, 178.20.29.89, 180.188.249.117, 185.89.42.136, 186.179.31.159, 186.179.31.204, 192.177.152.162, 193.43.143.37, 194.104.145.70, 194.114.137.14, 194.114.137.147, 194.114.137.32, 195.180.137.9, 198.50.154.225, 198.50.163.194, 204.217.131.188, 206.232.1.222, 206.232.2.34, 207.182.29.42, 221.252.28.18, 23.148.56.229, 23.230.32.48, 23.230.96.127, 2606:97c0:2a23:6d91:d74a:fa29:f098:69d8, 2606:97c0:7368:4dff:c3bc:4f3:4229:486b, 2606:97c0:cdf8:8cdb:ef6d:5a4f:7540:258a, 2606:97c0:d986:69cf:21e9:1af2:49e7:74e1, 38.154.4.216, 38.25.25.53,
show less
Open Proxy
VPN IP
Port Scan
Hacking
Brute-Force
Web App Attack
