🇺🇸
TPI-Abuse
2026-11-08 19:11:53
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210350) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:11:49.873700 2026] [security2:error] [pid 1565:tid 1565] [client 185.94.33.117:11017] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:11:49.873700 2026] [security2:error] [pid 1565:tid 1565] [client 185.94.33.117:11017] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||modmove.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "modmove.com"] [uri "/theatre/dolly-partons-smash-hit-musical-is-coming-to-brisbane/"] [unique_id "avDJdeAFKNujwbg4rCjpggAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 05:46:19
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 01:46:11.847468 2026] [security2:error] [pid 31310:tid 31359] [client 185.94.33.117:48155] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 01:46:11.847468 2026] [security2:error] [pid 31310:tid 31359] [client 185.94.33.117:48155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchbl8.nl|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchbl8.nl"] [uri "/blog/2016/06/27/"] [unique_id "auWAo9NJAtSTkR7hKXBLogAAAEw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 04:06:14
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 00:06:07.497953 2026] [security2:error] [pid 10441:tid 10441] [client 185.94.33.117:42559] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 00:06:07.497953 2026] [security2:error] [pid 10441:tid 10441] [client 185.94.33.117:42559] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.wardellbrown.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.wardellbrown.com"] [uri "/"] [unique_id "auLGL0Ow43UTURTNyxGghQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 14:11:55
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 10:11:51.512684 2026] [security2:error] [pid 18140:tid 18140] [client 185.94.33.117:41187] M ...
show more
(mod_security) mod_security (id:210730) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 10:11:51.512684 2026] [security2:error] [pid 18140:tid 18140] [client 185.94.33.117:41187] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mrobertdesignbuild.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mrobertdesignbuild.com"] [uri "/db_backup.sql"] [unique_id "aty8pzunDfa_HZdGPTxoJAAAACg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 19:31:59
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 15:31:55.719466 2026] [security2:error] [pid 17978:tid 17978] [client 185.94.33.117:38717] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 15:31:55.719466 2026] [security2:error] [pid 17978:tid 17978] [client 185.94.33.117:38717] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.yacht-register-holland.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.yacht-register-holland.com"] [uri "/worldwide-registration.html"] [unique_id "atkTK50kTeHGnOrbiNNmTAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-03-07 01:02:23
UTC ·
(8 months ago)
Fail2Ban banned 185.94.33.117 for security violations in jail wp-armour. Log: 2026/03/07 01:02:23 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 185.94.33.117 | Target: wplogin" , client: 185.94.33.117, server: [REDACTED], request: ...
show more
Fail2Ban banned 185.94.33.117 for security violations in jail wp-armour. Log: 2026/03/07 01:02:23 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 185.94.33.117 | Target: wplogin" , client: 185.94.33.117, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
2026-03-04 00:25:35
UTC ·
(8 months ago)
Forum/form spam
Web Spam
🇺🇸
webgobe
2026-02-03 07:59:33
UTC ·
(9 months ago)
jow-Joomla User : try to access forms...
Hacking
🇧🇪
voormedia
2026-01-30 22:30:50
UTC ·
(9 months ago)
Accessed trap at '/wp-login.php'
Web App Attack
2026-01-25 20:58:57
UTC ·
(9 months ago)
wordpress-trap
Web App Attack
🇺🇸
TPI-Abuse
2026-01-24 23:41:03
UTC ·
(9 months ago)
(mod_security) mod_security (id:210350) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 24 18:40:58.743850 2026] [security2:error] [pid 26047:tid 26047] [client 185.94.33.117:56465] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 24 18:40:58.743850 2026] [security2:error] [pid 26047:tid 26047] [client 185.94.33.117:56465] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||batfry.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "batfry.com"] [uri "/"] [unique_id "aXVYihHlDRinvMf94lAI8AAAAAc"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-12 17:21:33
UTC ·
(10 months ago)
(mod_security) mod_security (id:210350) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 12 12:21:26.731194 2025] [security2:error] [pid 5407:tid 5407] [client 185.94.33.117:48713] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.33.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 12 12:21:26.731194 2025] [security2:error] [pid 5407:tid 5407] [client 185.94.33.117:48713] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.powerastronomy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.powerastronomy.com"] [uri "/Runequest/doku.php"] [unique_id "aTxPFnkYbliu00fif3M3wgAAAAk"], referer: http://www.powerastronomy.com/Runequest/doku.php?id=cat888_bet&do=register
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-26 22:24:45
UTC ·
(11 months ago)
Forum/form spam
Web Spam
2025-11-24 15:30:03
UTC ·
(11 months ago)
multiple unauthorized attempts at Sun, 23 Nov 2025 08:33:47 +0000 a total of 1 times.
Brute-Force
🇳🇱
WeCloudit-Anti-Abuse
2025-10-18 09:10:06
UTC ·
(1 year ago)
WAF: Block IP which is in the web-spammers RBL 2- wsit
Email Spam
Brute-Force
