🇺🇸
TPI-Abuse
2026-11-10 11:31:12
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:31:09.422714 2026] [security2:error] [pid 29616:tid 29616] [client 91.245.236.26:9301] Mo ...
show more
(mod_security) mod_security (id:210350) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:31:09.422714 2026] [security2:error] [pid 29616:tid 29616] [client 91.245.236.26:9301] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||tulsatvmemories.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "tulsatvmemories.com"] [uri "/gb032605.html"] [unique_id "avMAfWiRZ_xN5SfwzgsyLgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 18:31:02
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 13:30:57.522271 2026] [security2:error] [pid 2246950:tid 2246957] [client 91.245.236.26:2502 ...
show more
(mod_security) mod_security (id:210350) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 13:30:57.522271 2026] [security2:error] [pid 2246950:tid 2246957] [client 91.245.236.26:25027] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.sonatro.io|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.sonatro.io"] [uri "/"] [unique_id "au4c4SPzBynFWAqLzIhGYwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 17:05:54
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 13:05:47.371397 2026] [security2:error] [pid 30179:tid 30179] [client 91.245.236.26:26219] M ...
show more
(mod_security) mod_security (id:210350) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 13:05:47.371397 2026] [security2:error] [pid 30179:tid 30179] [client 91.245.236.26:26219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.natural-history-conservation.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.natural-history-conservation.com"] [uri "/Spilsby.htm"] [unique_id "atefa6mngjcC6pkpDkP0AQAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
SpaceHost-Server
2026-09-20 22:25:45
UTC ·
(1 month ago)
Brute-Force
Web App Attack
🇫🇷
SpaceHost-Server
2026-09-19 22:24:13
UTC ·
(1 month ago)
Brute-Force
Web App Attack
🇩🇪
FD-IX
2026-09-19 11:04:04
UTC ·
(1 month ago)
Fail2Ban: WordPress brute-force attack detected.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-29 19:30:25
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 15:30:20.721472 2026] [security2:error] [pid 1045647:tid 1045647] [client 91.245.236.26:1992 ...
show more
(mod_security) mod_security (id:225170) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 15:30:20.721472 2026] [security2:error] [pid 1045647:tid 1045647] [client 91.245.236.26:19929] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||billthompsons.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "billthompsons.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ampUzBpOhCv6bDIfKt5-VAAAAAQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
DRI
2026-07-29 16:50:41
UTC ·
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇨🇦
DRI
2026-07-21 10:47:17
UTC ·
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇩🇪
FeG Deutschland
2026-07-20 02:17:38
UTC ·
(3 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-07-16 19:45:08
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 15:45:01.921651 2026] [security2:error] [pid 20802:tid 20802] [client 91.245.236.26:12091] M ...
show more
(mod_security) mod_security (id:225170) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 15:45:01.921651 2026] [security2:error] [pid 20802:tid 20802] [client 91.245.236.26:12091] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hazardvillefire.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hazardvillefire.org"] [uri "/wp-json/wp/v2/users"] [unique_id "alk0vR2Ypw5kgvIQKYccdQAAAAs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-12 04:30:08
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 00:30:04.415234 2026] [security2:error] [pid 2903:tid 2903] [client 91.245.236.26:15765] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 00:30:04.415234 2026] [security2:error] [pid 2903:tid 2903] [client 91.245.236.26:15765] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bernabeu.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bernabeu.org"] [uri "/wp-json/wp/v2/users"] [unique_id "alMYTIuSQTpy39bnyIbm6gAAAAg"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-16 08:11:52
UTC ·
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 04:11:48.418748 2026] [security2:error] [pid 8243:tid 8243] [client 91.245.236.26:60605] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 04:11:48.418748 2026] [security2:error] [pid 8243:tid 8243] [client 91.245.236.26:60605] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||byles.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "byles.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ajEFRKCroWzsGG04asr0DgAAABw"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-03 13:48:05
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 09:48:00.132530 2026] [security2:error] [pid 24397:tid 24397] [client 91.245.236.26:41545] M ...
show more
(mod_security) mod_security (id:225170) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 09:48:00.132530 2026] [security2:error] [pid 24397:tid 24397] [client 91.245.236.26:41545] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||benefit-design.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "benefit-design.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiAwkHNT-GNyNcS4U8atXwAAAAE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-31 11:50:47
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 07:50:42.725551 2026] [security2:error] [pid 20917:tid 20917] [client 91.245.236.26:21281] M ...
show more
(mod_security) mod_security (id:225170) triggered by 91.245.236.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 07:50:42.725551 2026] [security2:error] [pid 20917:tid 20917] [client 91.245.236.26:21281] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||macryder.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "macryder.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahwgkrl2vCVAXgqKWNdSvgAAAAM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
