🇺🇸
TPI-Abuse
2026-11-15 06:35:40
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210350) triggered by 89.34.65.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 01:35:32.498400 2026] [security2:error] [pid 27618:tid 27618] [client 89.34.65.247:18103] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 89.34.65.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 01:35:32.498400 2026] [security2:error] [pid 27618:tid 27618] [client 89.34.65.247:18103] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ictsl.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ictsl.net"] [uri "/productos/papelfiltracion/0000009f3a1314d9a.html"] [unique_id "avlStKYgfYIqR4_pSAdNaAAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 08:20:10
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 89.34.65.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 03:20:01.226554 2026] [security2:error] [pid 19880:tid 19880] [client 89.34.65.247:40511] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 89.34.65.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 03:20:01.226554 2026] [security2:error] [pid 19880:tid 19880] [client 89.34.65.247:40511] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.losbarbarosdelnorte.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.losbarbarosdelnorte.com"] [uri "/ideologia-politica/la-pobreza/"] [unique_id "avQlMZMxxAtue43IVWHALgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 05:46:11
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 89.34.65.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 00:46:06.477377 2026] [security2:error] [pid 13404:tid 13404] [client 89.34.65.247:11301] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 89.34.65.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 00:46:06.477377 2026] [security2:error] [pid 13404:tid 13404] [client 89.34.65.247:11301] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||savoiapower.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "savoiapower.com"] [uri "/biodiesel.html"] [unique_id "avQBHvTaoDwwdoU5CvCI7QAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 09:09:37
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 89.34.65.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 04:09:32.963128 2026] [security2:error] [pid 1187:tid 1187] [client 89.34.65.247:40843] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 89.34.65.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 04:09:32.963128 2026] [security2:error] [pid 1187:tid 1187] [client 89.34.65.247:40843] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||painting-with-numbers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "painting-with-numbers.com"] [uri "/blog/insurance-deductibles"] [unique_id "avA8TGshVlz1LCdi9_XWYgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 13:57:37
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 89.34.65.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 09:57:32.045081 2026] [security2:error] [pid 17854:tid 17854] [client 89.34.65.247:40225] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 89.34.65.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 09:57:32.045081 2026] [security2:error] [pid 17854:tid 17854] [client 89.34.65.247:40225] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.alexgitlin.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.alexgitlin.com"] [uri "/npp/freedom.htm"] [unique_id "auXzzJoqtzbPT_h37_ELpgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 14:49:45
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 89.34.65.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 10:49:36.036410 2026] [security2:error] [pid 14448:tid 14575] [client 89.34.65.247:21877] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 89.34.65.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 10:49:36.036410 2026] [security2:error] [pid 14448:tid 14575] [client 89.34.65.247:21877] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||killerrockandroll.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "killerrockandroll.com"] [uri "/killerrockandroll/REVIEWS/rgomgirlfriendsdead.html"] [unique_id "auILgL3VHTlF5upvOJkX1wAAAdA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
ICS Labs
2026-10-20 16:50:41
UTC ·
(3 weeks ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-10-20 UTC.
Brute-Force
🇩🇪
ghostwarriors
2026-10-20 04:50:05
UTC ·
(3 weeks ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-10-20 04:24:50
UTC ·
(3 weeks ago)
89.34.65.247 - - [20/Oct/2026:06:24:46 +0200] "GET / HTTP/1.1" 200 4582 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6.2 Mobile/15E148 Safari/604.1"
89.34.65.247 - - [20/Oct/2026:06:2 ...
show more
89.34.65.247 - - [20/Oct/2026:06:24:46 +0200] "GET / HTTP/1.1" 200 4582 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6.2 Mobile/15E148 Safari/604.1"
89.34.65.247 - - [20/Oct/2026:06:24:47 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 403 457 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6.2 Mobile/15E148 Safari/604.1"
89.34.65.247 - - [20/Oct/2026:06:24:47 +0200] "POST / HTTP/1.1" 200 578 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6.2 Mobile/15E148 Safari/604.1"
89.34.65.247 - - [20/Oct/2026:06:24:47 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 403 457 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6.2 Mobile/15E148 Safari/604.1"
89.34.65.247 - - [20/Oct/2026:06:24:48 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 403 457 "-" "M
show less
Web App Attack
Hacking
