🇺🇸
TPI-Abuse
2026-11-15 07:45:44
UTC ·
(14 hours ago)
(mod_security) mod_security (id:210350) triggered by 194.99.25.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 02:45:40.075352 2026] [security2:error] [pid 9581:tid 9581] [client 194.99.25.168:28409] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.25.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 02:45:40.075352 2026] [security2:error] [pid 9581:tid 9581] [client 194.99.25.168:28409] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||celebritybikinigossip.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "celebritybikinigossip.com"] [uri "/2010/04/holly-madison-bikini-pictures/"] [unique_id "avljJCktlG20xqxaf41VqAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 22:01:37
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 194.99.25.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 17:01:33.149953 2026] [security2:error] [pid 15301:tid 15301] [client 194.99.25.168:17571] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.25.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 17:01:33.149953 2026] [security2:error] [pid 15301:tid 15301] [client 194.99.25.168:17571] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cottrillcyclodyne.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cottrillcyclodyne.com"] [uri "/NetProd005_ISD.html"] [unique_id "avjaPWQmiXToCwZetFDFKQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 01:15:19
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 194.99.25.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 20:15:12.337279 2026] [security2:error] [pid 15176:tid 15176] [client 194.99.25.168:58551] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.25.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 20:15:12.337279 2026] [security2:error] [pid 15176:tid 15176] [client 194.99.25.168:58551] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.register-yacht-cook-islands.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.register-yacht-cook-islands.com"] [uri "/el/"] [unique_id "auk1oOuJvqHdfndD2CF-swAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 00:40:01
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.25.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 20:39:58.088562 2026] [security2:error] [pid 5602:tid 5602] [client 194.99.25.168:56733] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.25.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 20:39:58.088562 2026] [security2:error] [pid 5602:tid 5602] [client 194.99.25.168:56733] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||superiorhandyman.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "superiorhandyman.net"] [uri "/"] [unique_id "at_y3qwz4IOoTML5FgXb8AAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
island-freaks.com
2026-10-17 20:49:56
UTC ·
(4 weeks ago)
Attack Type: WordPress Exploit Bot attempt on /photo/113997/ | DNS 194.99.25.168 | Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36
Port Scan
Hacking
Bad Web Bot
Exploited Host
Web App Attack
🇬🇧
relianoid.com
2026-10-05 00:44:54
UTC ·
(1 month ago)
POST Abuse detected by Relianoid OSS Load Balancer - relianoid.com
Web Spam
🇸🇪
OnTheEdge
2026-09-14 16:37:29
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇸🇪
OnTheEdge
2026-09-14 16:37:29
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇩🇪
NxtGenIT
2026-09-11 14:29:59
UTC ·
(2 months ago)
CiscoASA Honeypot hit, Payload: "GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1" 200 -,
Brute-Force
🇨🇭
SOC [GOLINE SA]
2026-09-10 22:43:05
UTC ·
(2 months ago)
[RoutePulse | 2026-09-10T22:43:05Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 194.99.25.168
EVIDENCE: Cisco VPN RA Brute force on Cisco FTDv — portal under siege (48 real failed logins / 15 min): 1 attacker IP in 194.99.25.0/24 from campai ...
show more
[RoutePulse | 2026-09-10T22:43:05Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 194.99.25.168
EVIDENCE: Cisco VPN RA Brute force on Cisco FTDv — portal under siege (48 real failed logins / 15 min): 1 attacker IP in 194.99.25.0/24 from campaign AS26548 PUREVOLTAGE-INC - PureVoltage Hosting Inc. (211 IPs over the campaign); the attacker reuses · /24 aggregate member of 194.99.25.0/24
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
Brute-Force
Hacking
🇬🇧
[email protected]
2026-09-04 00:18:32
UTC ·
(2 months ago)
194.99.25.168 - - [04/Sep/2026:00:18:27 +0000] "GET /mod/forum/view.php?id=262&o=1&p=2%25%27%29%20OR%20EXTRACTVALUE%282604%2CCONCAT%280x7e%2C%28%28SELECT%20%28ELT%282604%3D2604%2C1%29%29%29%29%2C0x7e%29%29--%20- HTTP/1.1" 200 27843 "-" "Mozilla/5.0 ( ...
show more
194.99.25.168 - - [04/Sep/2026:00:18:27 +0000] "GET /mod/forum/view.php?id=262&o=1&p=2%25%27%29%20OR%20EXTRACTVALUE%282604%2CCONCAT%280x7e%2C%28%28SELECT%20%28ELT%282604%3D2604%2C1%29%29%29%29%2C0x7e%29%29--%20- HTTP/1.1" 200 27843 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
194.99.25.168 - - [04/Sep/2026:00:18:29 +0000] "GET /mod/forum/view.php?id=262&o=1&p=2%25%22%29%20OR%20EXTRACTVALUE%287708%2CCONCAT%280x7e%2C%28%28SELECT%20%28ELT%287708%3D7708%2C1%29%29%29%29%2C0x7e%29%29--%20- HTTP/1.1" 200 23023 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0"
194.99.25.168 - - [04/Sep/2026:00:18:30 +0000] "GET /mod/forum/view.php?id=262%29%29%20OR%20EXTRACTVALUE%286425%2CCONCAT%280x7e%2C%28%28SELECT%20%28ELT%286425%3D6425%2C1%29%29%29%29%2C0x7e%29%29--%20-&o=1&p=2 HTTP/1.1" 200 23022 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0"
...
show less
Web App Attack
🇩🇪
4server
2026-09-01 06:58:30
UTC ·
(2 months ago)
[TueSep0108:58:25.1323422026][security2:error][pid3820877:tid3820928][client194.99.25.168:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:alter\|drop\)\\\\\\\\b[a-z0-9] \\\\\\\\b\(\?:column\|database\|procedure\|table ...
show more
[TueSep0108:58:25.1323422026][security2:error][pid3820877:tid3820928][client194.99.25.168:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:alter\|drop\)\\\\\\\\b[a-z0-9] \\\\\\\\b\(\?:column\|database\|procedure\|table\)\\\\\\\\b\|delete[[:space:]].{1\,100} update[a-z0-9] set.{1\,100} =\|unionallselect\|\\\\\\\\bunion\\\\\\\\b.{1\,100}\?\\\\\\\\bselect\\\\\\\\b.{0\,200}[a-z0-9] from\|select\(\?:load_file\|char\?\\\\\\\\\(\)\|\(\?:insert\|r...\"atARGS:requests[1][body][requests][1][path].[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"315\"][id\"340144\"][rev\"38\"][msg\"Atomicorp.comWAFRules:GenericSQLinjectionprotection2\"][data\"138941\"][severity\"CRITICAL\"][tag\"SQLi\"][hostname\"morandi-trasporti.ch\"][uri\"/\"][unique_id\"apZ3kWl2GL4wa219PXa2UQAAAUg\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
ThreatsIntelz
2026-08-27 22:15:54
UTC ·
(2 months ago)
SSL-VPN brute-force / password-guessing attempts against FortiGate SSLVPN. Observed source subnet 194.99.25.0/24 (owner: FINEGROUPSERVERS-LEASE); 2 attempts above threshold.
Brute-Force
SSH
🇮🇩
bps-statistics
2026-08-25 23:09:35
UTC ·
(2 months ago)
WP Login Scan Activities: "2026-08-26T06:09:35.134+07:00" "/wp-login.php" "194.99.25.168" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
Web App Attack
