🇺🇸
TPI-Abuse
2026-11-15 21:07:27
UTC ·
(15 minutes ago)
(mod_security) mod_security (id:210350) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 16:07:20.056594 2026] [security2:error] [pid 1619:tid 1619] [client 185.94.34.161:19825] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 16:07:20.056594 2026] [security2:error] [pid 1619:tid 1619] [client 185.94.34.161:19825] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.themadwriter.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.themadwriter.us"] [uri "/snow-blind-8779.htm"] [unique_id "avofCEYjwrmLVkTwZx2svAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-13 20:00:14
UTC ·
(2 days ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-07 23:28:13
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:28:08.908738 2026] [security2:error] [pid 21680:tid 21680] [client 185.94.34.161:16411] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:28:08.908738 2026] [security2:error] [pid 21680:tid 21680] [client 185.94.34.161:16411] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||backstore.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "backstore.com"] [uri "/backstore/HT-7120.htm"] [unique_id "au-0CNIGv02kTyNL1mtQ2gAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 10:20:26
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 05:20:21.512514 2026] [security2:error] [pid 21560:tid 21560] [client 185.94.34.161:30465] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 05:20:21.512514 2026] [security2:error] [pid 21560:tid 21560] [client 185.94.34.161:30465] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||theledman.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "theledman.net"] [uri "/faq.html"] [unique_id "auxYZbBTqCk_XskcqMQPBgAAACw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 11:36:26
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 07:36:19.720204 2026] [security2:error] [pid 10960:tid 10960] [client 185.94.34.161:54411] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 07:36:19.720204 2026] [security2:error] [pid 10960:tid 10960] [client 185.94.34.161:54411] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.jerusalem-korczak-home.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.jerusalem-korczak-home.com"] [uri "/rek/kb/itel_o-en.htm"] [unique_id "atyYM-QTJazz7xONdOeAUQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-16 23:57:38
UTC ·
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 19:57:32.635440 2026] [security2:error] [pid 29886:tid 29886] [client 185.94.34.161:39271] M ...
show more
(mod_security) mod_security (id:210730) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 19:57:32.635440 2026] [security2:error] [pid 29886:tid 29886] [client 185.94.34.161:39271] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Barcalounger/Images/Danbury II/Stetson Bordeaux/originals/Thumbs.db"] [unique_id "agkEbG2FO65MewJBEOSEWQAAAAs"], referer: https://vitalitywebb.com/backstore/Barcalounger/Images/Danbury%20II/Stetson%20Bordeaux/originals/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-10 12:36:16
UTC ·
(11 months ago)
(mod_security) mod_security (id:225170) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 07:36:11.359397 2025] [security2:error] [pid 30248:tid 30248] [client 185.94.34.161:27031] M ...
show more
(mod_security) mod_security (id:225170) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 07:36:11.359397 2025] [security2:error] [pid 30248:tid 30248] [client 185.94.34.161:27031] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||sahinozalit.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sahinozalit.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aTlpO9hhpEmM6ksu-Xw7YQAAAAk"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-08 11:09:25
UTC ·
(11 months ago)
(mod_security) mod_security (id:225170) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 08 06:09:20.683086 2025] [security2:error] [pid 29966:tid 29966] [client 185.94.34.161:58423] M ...
show more
(mod_security) mod_security (id:225170) triggered by 185.94.34.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 08 06:09:20.683086 2025] [security2:error] [pid 29966:tid 29966] [client 185.94.34.161:58423] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thestardance.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thestardance.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aTax4Eq_4mpmE1xWzFwaYAAAAAo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇬
Vano Ganzzz
2025-11-29 11:10:19
UTC ·
(11 months ago)
Triggered Cloudflare WAF (ratelimit) from FI.
Action taken: BLOCK
ASN: 59651 (AS-QUALITYNETWORK)
Protocol: HTTP/2 (GET method)
Endpoint: /
Timestamp: 2025-11-29T11:10:19Z
Ray ID: 9a61a86e2c5b2d71
UA: Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebK ...
show more
Triggered Cloudflare WAF (ratelimit) from FI.
Action taken: BLOCK
ASN: 59651 (AS-QUALITYNETWORK)
Protocol: HTTP/2 (GET method)
Endpoint: /
Timestamp: 2025-11-29T11:10:19Z
Ray ID: 9a61a86e2c5b2d71
UA: Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Mobile Safari/537.36 EdgA/128.0.0.0
show less
Bad Web Bot
2025-08-17 05:03:53
UTC ·
(1 year ago)
WordPress Brute Force
Brute-Force
🇨🇭
backslash
2025-06-25 09:10:06
UTC ·
(1 year ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇩🇪
hbrks
2025-03-22 17:35:33
UTC ·
(1 year ago)
GET http://marche-be.com/
Web Spam
Hacking
Bad Web Bot
2024-10-31 02:16:31
UTC ·
(2 years ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇩🇪
css672
2024-10-17 09:19:26
UTC ·
(2 years ago)
Credential brute-force attacks on webpage logins [18,21].
remote_addr: 185.94.34.161, error_code: 76
username:
[email protected]
password: [censored]
fruad_score: 0, abuseConfidenceScore: 0
css672: V.4.10.16.1436
Brute-Force
Web App Attack
🇫🇷
www.unitiz.com
2024-05-29 10:26:05
UTC ·
(2 years ago)
Probing non-existent URLs
Bad Web Bot
Web App Attack
