🇺🇸
TPI-Abuse
2026-11-10 11:25:00
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:24:56.522654 2026] [security2:error] [pid 31266:tid 31266] [client 194.104.8.59:53169] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:24:56.522654 2026] [security2:error] [pid 31266:tid 31266] [client 194.104.8.59:53169] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.losbarbarosdelnorte.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.losbarbarosdelnorte.com"] [uri "/politica-local/disculpenlo-es-de-derecha-3/"] [unique_id "avL_CDbgEb9a9B18t-hZfQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 12:10:08
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 07:10:01.789705 2026] [security2:error] [pid 18835:tid 18835] [client 194.104.8.59:37463] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 07:10:01.789705 2026] [security2:error] [pid 18835:tid 18835] [client 194.104.8.59:37463] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||goseethenurse.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "goseethenurse.com"] [uri "/2018/10/30/school-nurses-guide-pink-eye-conjunctivitis/"] [unique_id "avG4GUYVtY4Q4WqsbzGf4wAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 06:09:39
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 01:09:35.155201 2026] [security2:error] [pid 25382:tid 25382] [client 194.104.8.59:27491] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 01:09:35.155201 2026] [security2:error] [pid 25382:tid 25382] [client 194.104.8.59:27491] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.themadwriter.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.themadwriter.us"] [uri "/success-stories"] [unique_id "avFjn88Vk5CnTTFw42J97QAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 22:36:50
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 17:36:45.310736 2026] [security2:error] [pid 22231:tid 22231] [client 194.104.8.59:54001] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 17:36:45.310736 2026] [security2:error] [pid 22231:tid 22231] [client 194.104.8.59:54001] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lightningbug.farm|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lightningbug.farm"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "au-n_Zz7WJFyncMRLV4NggAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 19:12:22
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 14:12:18.555253 2026] [security2:error] [pid 13474:tid 13474] [client 194.104.8.59:22453] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 14:12:18.555253 2026] [security2:error] [pid 13474:tid 13474] [client 194.104.8.59:22453] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "auuDkqa1Tu-xcUY_ylAG9AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇽
octageeks.com
2026-10-04 04:09:38
UTC ·
(1 month ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇩🇪
LRob
2026-09-27 04:29:24
UTC ·
(1 month ago)
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack t ...
show more
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack tools, blocked on sight. Please check the machine behind it. | method: POST | path: /xmlrpc.php | 2026-09-27 04:29 UTC
show less
Web App Attack
Hacking
🇩🇪
stinpriza
2026-09-03 19:49:46
UTC ·
(2 months ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-08-17 00:24:10
UTC ·
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 20:24:01.644813 2026] [security2:error] [pid 9056:tid 9066] [client 194.104.8.59:59393] ModSe ...
show more
(mod_security) mod_security (id:210730) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 20:24:01.644813 2026] [security2:error] [pid 9056:tid 9066] [client 194.104.8.59:59393] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aafm.org|F|2"] [data ".gafm.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aafm.org"] [uri "/www.GAFM.com"] [unique_id "aoJUoTT_tuo_3xNB8JYt0AAAAQM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-23 21:03:00
UTC ·
(4 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
nationaleventpros.com
2026-03-21 23:02:10
UTC ·
(7 months ago)
WordPress login attempt
Brute-Force
🇺🇸
TPI-Abuse
2026-03-21 20:12:01
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 16:11:55.833442 2026] [security2:error] [pid 8444:tid 8457] [client 194.104.8.59:14939] ModSe ...
show more
(mod_security) mod_security (id:225170) triggered by 194.104.8.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 16:11:55.833442 2026] [security2:error] [pid 8444:tid 8457] [client 194.104.8.59:14939] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ewoolsey.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ewoolsey.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab77i8Giq-rnFgs6JG6iyQAAAIk"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xmission.com
2026-03-03 21:33:38
UTC ·
(8 months ago)
194.104.8.59 - - [03/Mar/2026:14:33:37 -0700] "POST /wp-login.php HTTP/1.1" 200 2354 "https://dooce.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
...
Brute-Force
🇩🇪
Hazzard
2025-12-27 03:50:20
UTC ·
(10 months ago)
(wordpress) Failed wordpress login from 194.104.8.59 (RU/Russia/-/-/-/[redacted])
Brute-Force
2025-11-26 00:02:31
UTC ·
(11 months ago)
wordpress-trap
Web App Attack
