93.177.118.196

(mod_security) mod_security (id:210350) triggered by 93.177.118.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 00:07:49.349050 2026] [security2:error] [pid 11056:tid 11056] [client 93.177.118.196:22793] ... show more (mod_security) mod_security (id:210350) triggered by 93.177.118.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 00:07:49.349050 2026] [security2:error] [pid 11056:tid 11056] [client 93.177.118.196:22793] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/posts/7988"] [unique_id "avP4JaUOy9K1-fOiejkNRAAAAAE"] show less

(mod_security) mod_security (id:210350) triggered by 93.177.118.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 23:43:56.537384 2026] [security2:error] [pid 13348:tid 13348] [client 93.177.118.196:25975] ... show more (mod_security) mod_security (id:210350) triggered by 93.177.118.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 23:43:56.537384 2026] [security2:error] [pid 13348:tid 13348] [client 93.177.118.196:25975] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.andrejblatnik.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.andrejblatnik.com"] [uri "/specialties.html"] [unique_id "avKhDFLRDROgJrzU88FtRgAAAAc"] show less

Brute force

(mod_security) mod_security (id:210350) triggered by 93.177.118.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 13:57:54.745318 2026] [security2:error] [pid 12837:tid 12837] [client 93.177.118.196:9733] ... show more (mod_security) mod_security (id:210350) triggered by 93.177.118.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 13:57:54.745318 2026] [security2:error] [pid 12837:tid 12837] [client 93.177.118.196:9733] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paleopathologist.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paleopathologist.com"] [uri "/category/uncategorized/"] [unique_id "auDmImbBL-GZhizeicVcXAAAAAc"] show less

This IP was detected by CrowdSec triggering crowdsecurity/http-bf-wordpress_bf_xmlrpc. Ip 93.177.118.196 performed 'crowdsecurity/http-bf-wordpress_bf_xmlrpc' (6 events over 8.585020938s) at 2026-06-13 13:22:08.231752202 +0000 UTC

(mod_security) mod_security (id:210350) triggered by 93.177.118.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 17 17:02:36.585246 2025] [security2:error] [pid 24746:tid 24746] [client 93.177.118.196:55791] ... show more (mod_security) mod_security (id:210350) triggered by 93.177.118.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 17 17:02:36.585246 2025] [security2:error] [pid 24746:tid 24746] [client 93.177.118.196:55791] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||synergystudios.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "synergystudios.org"] [uri "/"] [unique_id "aUMofOQgaujynM6wI2B1PwAAAAY"] show less

Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER

Wordpress hacking attempt

(mod_security) mod_security (id:6) triggered by 93.177.118.196 (RU/Russia/-): 1 in the last 3600 secs; Ports: 80,443; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 27 09:47:43.594913 2025] [security2:error] [pid 13939:tid 13969] [client 93.177.118 ... show more (mod_security) mod_security (id:6) triggered by 93.177.118.196 (RU/Russia/-): 1 in the last 3600 secs; Ports: 80,443; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 27 09:47:43.594913 2025] [security2:error] [pid 13939:tid 13969] [client 93.177.118.196:10207] [client 93.177.118.196] ModSecurity: Access denied with connection close (phase 2). Pattern match "wp-login.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "62"] [id "6"] [severity "CRITICAL"] [hostname "sieuthimaychu.vn"] [uri "/wp-login.php"] [unique_id "aDUnz3oDtJsb-3mVztAvpgAAAAM"] show less

block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8

GlobalProtect login attempts with user tpickles.

(mod_security) mod_security (id:210492) triggered by 93.177.118.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 08 23:49:01.930562 2025] [security2:error] [pid 2672296:tid 2672296] [client 93.177.118.196:37 ... show more (mod_security) mod_security (id:210492) triggered by 93.177.118.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 08 23:49:01.930562 2025] [security2:error] [pid 2672296:tid 2672296] [client 93.177.118.196:37155] [client 93.177.118.196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "albioncapitalfund.starrmail.net"] [uri "/.env"] [unique_id "Z6gzvdhZl7CFtVFOm_uVxQAAAAM"], referer: https://a00036.tiiny.site/ show less

SMS pumping attack from foreign country

Trigger: LF_DISTATTACK

GlobalProtect login attempts with user postmaster.