🇺🇸
TPI-Abuse
2026-11-15 10:51:51
UTC ·
(26 minutes ago)
(mod_security) mod_security (id:210350) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 05:51:45.350242 2026] [security2:error] [pid 875:tid 875] [client 194.99.24.149:52173] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 05:51:45.350242 2026] [security2:error] [pid 875:tid 875] [client 194.99.24.149:52173] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.flavornet.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.flavornet.org"] [uri "/info/17066-67-0.html"] [unique_id "avmOwbh5RuhL6gh5Jpj41QAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 22:43:21
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 17:43:15.147618 2026] [security2:error] [pid 21662:tid 21662] [client 194.99.24.149:55337] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 17:43:15.147618 2026] [security2:error] [pid 21662:tid 21662] [client 194.99.24.149:55337] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "aupjg_Jm207dcrovCoK7eQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 08:05:59
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:05:53.183409 2026] [security2:error] [pid 30037:tid 30037] [client 194.99.24.149:41381] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:05:53.183409 2026] [security2:error] [pid 30037:tid 30037] [client 194.99.24.149:41381] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paleopathologist.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paleopathologist.com"] [uri "/uncategorized/paleopathologist-becomes-professorpaleopathologist/"] [unique_id "aumV4UXFaBASlqGuTIRNIAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 12:31:55
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 08:31:52.453918 2026] [security2:error] [pid 27633:tid 27633] [client 194.99.24.149:45973] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 08:31:52.453918 2026] [security2:error] [pid 27633:tid 27633] [client 194.99.24.149:45973] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bostonlog.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bostonlog.com"] [uri "/category/box-brad/"] [unique_id "auSOOFz4ad3YL5DzA7M3RwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 19:16:25
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:16:15.330530 2026] [security2:error] [pid 18982:tid 18982] [client 194.99.24.149:42075] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:16:15.330530 2026] [security2:error] [pid 18982:tid 18982] [client 194.99.24.149:42075] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||sydneysue.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "sydneysue.com"] [uri "/groomed-for-success.html"] [unique_id "auJJ_14sqhVkWBBqlTyXbgAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 02:09:29
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 22:09:22.135651 2026] [security2:error] [pid 25348:tid 25348] [client 194.99.24.149:18889] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 22:09:22.135651 2026] [security2:error] [pid 25348:tid 25348] [client 194.99.24.149:18889] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.thecrimsonpirate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.thecrimsonpirate.com"] [uri "/blog/"] [unique_id "atwTUvo4t6knF0MJSlkAiQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-15 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-11 00:10:02
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇩🇪
LRob
2026-05-21 20:30:09
UTC ·
(5 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-05-21 15:06:51
UTC ·
(5 months ago)
Fail2Ban banned 194.99.24.149 for security violations in jail wp-armour. Log: 2026/05/21 15:06:50 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 194.99.24.149 | Target: wplogin" , client: 194.99.24.149, server: [REDACTED], request: ...
show more
Fail2Ban banned 194.99.24.149 for security violations in jail wp-armour. Log: 2026/05/21 15:06:50 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 194.99.24.149 | Target: wplogin" , client: 194.99.24.149, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇺🇸
interbiznw.com
2026-05-16 02:31:04
UTC ·
(5 months ago)
wordpress-bruteforce
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-05-03 11:04:19
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 03 07:04:13.685948 2026] [security2:error] [pid 16328:tid 16328] [client 194.99.24.149:20615] M ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 03 07:04:13.685948 2026] [security2:error] [pid 16328:tid 16328] [client 194.99.24.149:20615] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||plaisance.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "plaisance.us"] [uri "/wp-json/wp/v2/users"] [unique_id "afcrrZAgoB1XA7mqMXGmRQAAAAE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
ptlab
2026-04-27 04:46:11
UTC ·
(6 months ago)
Detected wp_login attack from WP-host.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 18:40:23
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 14:40:18.606593 2026] [security2:error] [pid 11795:tid 11795] [client 194.99.24.149:55343] M ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.24.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 14:40:18.606593 2026] [security2:error] [pid 11795:tid 11795] [client 194.99.24.149:55343] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||balmedia.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "balmedia.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adAJkqdieuGjMRAS6LvgtgAAABs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
