🇺🇸
TPI-Abuse
2026-11-13 13:17:01
UTC ·
(6 hours ago)
(mod_security) mod_security (id:210350) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 08:16:56.144652 2026] [security2:error] [pid 31530:tid 31530] [client 194.99.25.190:14495] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 08:16:56.144652 2026] [security2:error] [pid 31530:tid 31530] [client 194.99.25.190:14495] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.vitalitywebb.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.vitalitywebb.com"] [uri "/backstore/PA-400H.htm"] [unique_id "avcNyHLBOWPg8xcO7PcY9QAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 12:27:05
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 07:26:57.136395 2026] [security2:error] [pid 22646:tid 22646] [client 194.99.25.190:50497] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 07:26:57.136395 2026] [security2:error] [pid 22646:tid 22646] [client 194.99.25.190:50497] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.microdot.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.microdot.net"] [uri "/nlp/precise-communication/meta-model-5.shtml"] [unique_id "avBqkaXDQ_9VOOW_psTyMwAAAE8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 00:41:24
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 20:41:19.063305 2026] [security2:error] [pid 1635:tid 1635] [client 194.99.25.190:15127] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 20:41:19.063305 2026] [security2:error] [pid 1635:tid 1635] [client 194.99.25.190:15127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.atlanticcitypartybuses.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.atlanticcitypartybuses.com"] [uri "/robots.txt"] [unique_id "auPnr6PvcVZJSKL6-e-w4gAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 12:51:43
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 08:51:37.696914 2026] [security2:error] [pid 13895:tid 13895] [client 194.99.25.190:54055] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 08:51:37.696914 2026] [security2:error] [pid 13895:tid 13895] [client 194.99.25.190:54055] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.body-tone.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.body-tone.com"] [uri "/tenssafety.htm"] [unique_id "atyp2ewgl2wcS8C-l6MtuAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 23:35:26
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 19:35:20.829861 2026] [security2:error] [pid 8445:tid 8445] [client 194.99.25.190:38903] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 19:35:20.829861 2026] [security2:error] [pid 8445:tid 8445] [client 194.99.25.190:38903] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||banis-associates.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "banis-associates.com"] [uri "/petcareconfessions.com/"] [unique_id "atqduGk5Ea2fEC4AxQehygAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇭🇰
sandra361
2026-10-07 00:52:18
UTC ·
(1 month ago)
Port scan detected: 9 attempts across 1 port (50000). | Evidence: GHOST_SCAN: IN=eth0 SRC=194.99.25.190 LEN=52 TOS=0x14 PREC=0x00 TTL=113 ID=8270 DF PROTO=TCP SPT=39019 DPT=50000 WINDOW=42340 RES=0x00 SYN URGP=0
Port Scan
🇺🇸
TPI-Abuse
2026-10-05 15:14:52
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 11:14:44.767193 2026] [security2:error] [pid 12525:tid 12525] [client 194.99.25.190:52937] M ...
show more
(mod_security) mod_security (id:210730) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 11:14:44.767193 2026] [security2:error] [pid 12525:tid 12525] [client 194.99.25.190:52937] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Barcalounger/Images/Ashton II Recliner/Ashton II Recliner/Havana Brown/Thumbs.db"] [unique_id "asO-5F4RvfT61HDYNwLmmgAAAAE"], referer: https://vitalitywebb.com/backstore/Barcalounger/Images/Ashton%20II%20Recliner/Ashton%20II%20Recliner/Havana%20Brown/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ThreatsIntelz
2026-08-27 22:15:54
UTC ·
(2 months ago)
SSL-VPN brute-force / password-guessing attempts against FortiGate SSLVPN. Observed source subnet 194.99.25.0/24 (owner: FINEGROUPSERVERS-LEASE); 2 attempts above threshold.
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-08-24 17:13:47
UTC ·
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 13:13:43.268174 2026] [security2:error] [pid 14899:tid 14899] [client 194.99.25.190:19089] M ...
show more
(mod_security) mod_security (id:210730) triggered by 194.99.25.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 13:13:43.268174 2026] [security2:error] [pid 14899:tid 14899] [client 194.99.25.190:19089] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Catnapper/images/Omni/Thumbs.db"] [unique_id "aox7x4Z-rV8Z6a4Xn9QtJgAAABE"], referer: https://vitalitywebb.com/backstore/Catnapper/images/Omni/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
conseilgouz
2026-07-21 21:28:40
UTC ·
(3 months ago)
jow-Joomla User : try to access forms...
Hacking
🇷🇸
Smel
2026-06-24 04:52:12
UTC ·
(4 months ago)
HTTP/80/443/8080 Unauthorized Probe, Hack -
Hacking
Web App Attack
🇬🇧
Oakley
2026-05-30 00:26:13
UTC ·
(5 months ago)
(mod_security) mod_security (id:900177) triggered by 194.99.25.190 (US/United States/-): 5 in the last 900 secs
Web App Attack
Hacking
🇨🇭
backslash
2026-05-17 05:57:00
UTC ·
(5 months ago)
block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8
Bad Web Bot
🇬🇧
Oakley
2026-04-22 09:59:13
UTC ·
(6 months ago)
(confirmed_bot_sig) Confirmed bot
Hacking
🇨🇭
backslash
2026-04-16 14:03:23
UTC ·
(6 months ago)
block ruleset 798ECF92F12ADC636D3520C2890AF17ADEFDE3BE
Bad Web Bot
