🇺🇸
TPI-Abuse
2026-05-30 23:42:07
(1 week ago)
(mod_security) mod_security (id:217210) triggered by 194.71.227.149 (149.227.71.194.in-addr.arpa): 1 ...
show more
(mod_security) mod_security (id:217210) triggered by 194.71.227.149 (149.227.71.194.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 30 19:42:01.434322 2026] [security2:error] [pid 13831:tid 13831] [client 194.71.227.149:55676] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||bodiehistory.com:443|F|4"] [data "CONNECT bodiehistory.com:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bodiehistory.com"] [uri "/"] [unique_id "aht1yaq6FbPPkAPkVrHFbgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xmission.com
2026-05-30 02:43:36
(1 week ago)
194.71.227.149 - - [29/May/2026:20:00:20 -0600] "CONNECT dooce.com:443 HTTP/1.1" 400 150 "-" "-"
194 ...
show more
194.71.227.149 - - [29/May/2026:20:00:20 -0600] "CONNECT dooce.com:443 HTTP/1.1" 400 150 "-" "-"
194.71.227.149 - - [29/May/2026:20:31:22 -0600] "CONNECT dooce.com:443 HTTP/1.1" 400 150 "-" "-"
194.71.227.149 - - [29/May/2026:20:43:35 -0600] "CONNECT dooce.com:443 HTTP/1.1" 400 150 "-" "-"
194.71.227.149 - - [29/May/2026:20:43:36 -0600] "CONNECT dooce.com:443 HTTP/1.1" 400 150 "-" "-"
194.71.227.149 - - [29/May/2026:20:43:36 -0600] "CONNECT dooce.com:443 HTTP/1.1" 400 150 "-" "-"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-18 00:56:31
(3 weeks ago)
(mod_security) mod_security (id:217210) triggered by 194.71.227.149 (149.227.71.194.in-addr.arpa): 1 ...
show more
(mod_security) mod_security (id:217210) triggered by 194.71.227.149 (149.227.71.194.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 20:56:25.734557 2026] [security2:error] [pid 26370:tid 26379] [client 194.71.227.149:48094] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||icecc.com:443|F|4"] [data "CONNECT icecc.com:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "icecc.com"] [uri "/"] [unique_id "agpjuc0VzW89XOq7VwxU-AAAAIU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ipblock.com
2026-05-12 07:25:00
(4 weeks ago)
IPBlock protected site ID [4055-d][s=01].
Persistent 404, vulnerability scanner
Hacking
Bad Web Bot
Web App Attack
🇸🇮
administrator
2026-05-04 16:52:11
(1 month ago)
2026-04-06 08:16:21,219 fail2ban.actions [117784]: NOTICE [apache-badbots] Ban 194.71.227.14 ...
show more
2026-04-06 08:16:21,219 fail2ban.actions [117784]: NOTICE [apache-badbots] Ban 194.71.227.149
2026-04-06 08:16:21,219 fail2ban.actions [117784]: NOTICE [apache-badbots] Ban 194.71.227.149
2026-04-06 08:16:21,219 fail2ban.actions [117784]: NOTICE [apache-badbots] Ban 194.71.227.149
...
show less
Bad Web Bot
Web Spam
Email Spam
Blog Spam
Port Scan
Brute-Force
Web App Attack
🇩🇪
Skyrider
2026-04-17 18:12:06
(1 month ago)
crowdsecurity/http-open-proxy
Hacking
🇺🇸
TPI-Abuse
2026-04-16 21:21:50
(1 month ago)
(mod_security) mod_security (id:217210) triggered by 194.71.227.149 (149.227.71.194.in-addr.arpa): 1 ...
show more
(mod_security) mod_security (id:217210) triggered by 194.71.227.149 (149.227.71.194.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 16 17:21:45.885001 2026] [security2:error] [pid 3741649:tid 3741649] [client 194.71.227.149:35887] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||bennecelli.com:443|F|4"] [data "CONNECT bennecelli.com:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bennecelli.com"] [uri "/"] [unique_id "aeFS6dX4n6fMaqhV7BNwJgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-16 09:39:25
(1 month ago)
(mod_security) mod_security (id:217210) triggered by 194.71.227.149 (149.227.71.194.in-addr.arpa): 1 ...
show more
(mod_security) mod_security (id:217210) triggered by 194.71.227.149 (149.227.71.194.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 16 05:39:19.625683 2026] [security2:error] [pid 2860686:tid 2860686] [client 194.71.227.149:41103] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||www.cameronwv.com:443|F|4"] [data "CONNECT www.cameronwv.com:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cameronwv.com"] [uri "/"] [unique_id "aeCuR0AKoSr1uu7Rlg6G-QAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-15 16:09:46
(1 month ago)
(mod_security) mod_security (id:217210) triggered by 194.71.227.149 (149.227.71.194.in-addr.arpa): 1 ...
show more
(mod_security) mod_security (id:217210) triggered by 194.71.227.149 (149.227.71.194.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 15 12:09:41.962876 2026] [security2:error] [pid 3968082:tid 3968082] [client 194.71.227.149:42531] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||haverhillhouse.com:443|F|4"] [data "CONNECT haverhillhouse.com:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "haverhillhouse.com"] [uri "/"] [unique_id "ad-4RUyNbrs6ID7a53UOJwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-04-15 05:19:37
(1 month ago)
[WedApr1507:19:31.8589162026][security2:error][pid3248770:tid3248790][client194.71.227.149:0]ModSecu ...
show more
[WedApr1507:19:31.8589162026][security2:error][pid3248770:tid3248790][client194.71.227.149:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\<\?/\?\?script\|\(\?:\<\|\<\?/\)\(\?:\(\?:java\|vb\)script\|about\|applet\|activex\|chrome\|qx\?ss\|embed\)\|\<\?/\?i\?frame\\\\\\\\b\|\<\?imgsrc\?=\|\<\?basehref\?=\)\"atARGS:custom_U387.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"1010\"][id\"340147\"][rev\"163\"][msg\"Atomicorp.comWAFRules:PotentialCrossSiteScriptingAttack\"][data\"\<imgsrc=\"][severity\"CRITICAL\"][hostname\"bno.ch\"][uri\"/scripts/form-u386.php\"][unique_id\"ad8f4249ryXvyOyw4eznCQAAANE\"]\,referer:http://bno.ch/contatti.html
show less
Port Scan
Brute-Force
Web App Attack
🇩🇪
Skyrider
2026-04-14 05:17:16
(1 month ago)
crowdsecurity/http-open-proxy
Hacking
🇮🇹
VHosting
2026-04-10 05:01:40
(2 months ago)
Detected attack and reported by a human
Brute-Force
Web App Attack
SSH
DDoS Attack
Exploited Host
Bad Web Bot