🇺🇸
TPI-Abuse
2026-11-13 09:45:51
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:45:45.540693 2026] [security2:error] [pid 10361:tid 10361] [client 194.99.24.48:63971] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:45:45.540693 2026] [security2:error] [pid 10361:tid 10361] [client 194.99.24.48:63971] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||glassicannex.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "glassicannex.org"] [uri "/homecomi.htm"] [unique_id "avbcSRhbiVY6fbVi-j9MfAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 04:55:21
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 00:55:14.453231 2026] [security2:error] [pid 10869:tid 10869] [client 194.99.24.48:22041] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 00:55:14.453231 2026] [security2:error] [pid 10869:tid 10869] [client 194.99.24.48:22041] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/tag/koch-brothers/"] [unique_id "auQjMgMYi10lziQbKEEqDQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 14:41:51
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 10:41:47.643069 2026] [security2:error] [pid 14217:tid 14217] [client 194.99.24.48:62841] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 10:41:47.643069 2026] [security2:error] [pid 14217:tid 14217] [client 194.99.24.48:62841] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.powerkiteforum.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.powerkiteforum.com"] [uri "/viewthread.php"] [unique_id "auNbK50FaeoetXjyPTKATAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 13:27:03
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:26:45.315532 2026] [security2:error] [pid 21184:tid 21184] [client 194.99.24.48:38951] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:26:45.315532 2026] [security2:error] [pid 21184:tid 21184] [client 194.99.24.48:38951] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||accordionstars.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "accordionstars.com"] [uri "/Previous-Years/2016/2016-Stars/Alex-Sevastian"] [unique_id "atDUlYnkNiBJ36UMkK2HAQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
JimArchon72
2026-10-12 15:15:03
UTC ·
(1 month ago)
2026/10/12 15:13:18 "GET /wp-login.php?action=register HTTP/1.1"
Web App Attack
🇪🇸
librebit
2026-06-22 04:29:20
UTC ·
(4 months ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-04-29 10:32:32
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 06:32:25.416307 2026] [security2:error] [pid 15764:tid 15764] [client 194.99.24.48:61371] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 06:32:25.416307 2026] [security2:error] [pid 15764:tid 15764] [client 194.99.24.48:61371] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||seniorservicetravel.banis-associates.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "seniorservicetravel.banis-associates.com"] [uri "/s3cmd.ini"] [unique_id "afHeOa9aQAv0GNI9D9lwmQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-29 08:58:01
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 04:57:53.341022 2026] [security2:error] [pid 15119:tid 15119] [client 194.99.24.48:38853] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 04:57:53.341022 2026] [security2:error] [pid 15119:tid 15119] [client 194.99.24.48:38853] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sherinemec-wies.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sherinemec-wies.com"] [uri "/s3cmd.ini"] [unique_id "afHIEfh6XSF2rTuDjBtmLQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-29 03:32:48
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 23:32:39.974284 2026] [security2:error] [pid 27255:tid 27255] [client 194.99.24.48:16289] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 23:32:39.974284 2026] [security2:error] [pid 27255:tid 27255] [client 194.99.24.48:16289] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.cyberaffiliatesoftware.com.crazycoin.net|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.cyberaffiliatesoftware.com.crazycoin.net"] [uri "/s3cmd.ini"] [unique_id "afF71_fFhg1CLRTTyXmN7wAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-27 20:51:54
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 16:51:46.259168 2026] [security2:error] [pid 17712:tid 17712] [client 194.99.24.48:17251] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 16:51:46.259168 2026] [security2:error] [pid 17712:tid 17712] [client 194.99.24.48:17251] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.carminestogo.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.carminestogo.com"] [uri "/s3cmd.ini"] [unique_id "ae_MYhkbqf9DklaUo8h4UQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Lino Project
2026-04-27 01:48:21
UTC ·
(6 months ago)
194.99.24.48 - - [27/Apr/2026:03:48:20 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3987 "-" "Mozilla/5.0 (Linux; arm_64; Android 10; COL-L29) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.136 YaBrowser/20.2.6.114.00 Mobile SA/1 Safari/537.36"
.. ...
show more
194.99.24.48 - - [27/Apr/2026:03:48:20 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3987 "-" "Mozilla/5.0 (Linux; arm_64; Android 10; COL-L29) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.136 YaBrowser/20.2.6.114.00 Mobile SA/1 Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-26 12:06:42
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 08:06:39.135728 2026] [security2:error] [pid 16802:tid 16802] [client 194.99.24.48:58003] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 08:06:39.135728 2026] [security2:error] [pid 16802:tid 16802] [client 194.99.24.48:58003] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.goldeys.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.goldeys.com"] [uri "/s3cmd.ini"] [unique_id "ae3_z0Hrv6Og6UXdSRPTbQAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-02-12 15:05:13
UTC ·
(9 months ago)
wordpress-trap
Web App Attack
🇺🇸
TPI-Abuse
2025-03-21 16:07:10
UTC ·
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 21 12:07:07.040717 2025] [security2:error] [pid 24438:tid 24438] [client 194.99.24.48:11437] [cl ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.24.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 21 12:07:07.040717 2025] [security2:error] [pid 24438:tid 24438] [client 194.99.24.48:11437] [client 194.99.24.48] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||manaplas.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "manaplas.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "Z92Oq17emJC4pVWubIC7mAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
lp
2025-03-18 17:53:15
UTC ·
(1 year ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 194.99.24.48
2025-03-18T18:31:38+01:00 vpn Access-Reject 'jlarson' station: 194.99.24.48 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted> ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 194.99.24.48
2025-03-18T18:31:38+01:00 vpn Access-Reject 'jlarson' station: 194.99.24.48 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
