🇺🇸
TPI-Abuse
2026-11-14 10:02:18
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 05:02:13.946286 2026] [security2:error] [pid 14843:tid 14843] [client 194.99.27.113:10731] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 05:02:13.946286 2026] [security2:error] [pid 14843:tid 14843] [client 194.99.27.113:10731] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ctrussell.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ctrussell.us"] [uri "/e7db3006c018c1c4862566bd000abc75/072a88e5e907c62a86256b330013fc14_7b4ad6db.html"] [unique_id "avgxpfpFLo-l-lF5aWumzAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-11 22:42:29
UTC ·
(3 days ago)
Automated scanner probing RD Web Access login pages
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 09:01:59
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:01:54.327119 2026] [security2:error] [pid 20131:tid 20131] [client 194.99.27.113:52043] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:01:54.327119 2026] [security2:error] [pid 20131:tid 20131] [client 194.99.27.113:52043] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||backtosleep.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "backtosleep.com"] [uri "/backstore/about-us.htm"] [unique_id "avLdgi8ciHt95MaRvP74SwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 19:08:30
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 14:08:26.405718 2026] [security2:error] [pid 32467:tid 32467] [client 194.99.27.113:11845] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 14:08:26.405718 2026] [security2:error] [pid 32467:tid 32467] [client 194.99.27.113:11845] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.hotpay.co|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.hotpay.co"] [uri "/"] [unique_id "auzUKqnsGCxHAlke4t9kKgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 09:45:18
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 04:45:11.315499 2026] [security2:error] [pid 22958:tid 22958] [client 194.99.27.113:11343] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 04:45:11.315499 2026] [security2:error] [pid 22958:tid 22958] [client 194.99.27.113:11343] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.greenquince.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.greenquince.com"] [uri "/2013/09/custom-letterpress-cards-for-barbara-of-bmjnyc-jewelry/"] [unique_id "aumtJwL5YxVpMxmVdXFnTwAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 03:43:41
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 22:43:38.340189 2026] [security2:error] [pid 16076:tid 16076] [client 194.99.27.113:19795] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 22:43:38.340189 2026] [security2:error] [pid 16076:tid 16076] [client 194.99.27.113:19795] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "aulYatuZGeN07cuXULeScAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-10-30 13:00:14
UTC ·
(2 weeks ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇪🇸
librebit
2026-06-20 10:34:13
UTC ·
(4 months ago)
Brute force
Brute-Force
🇵🇱
sefinek.net
2026-02-03 11:56:38
UTC ·
(9 months ago)
Triggered Cloudflare WAF (firewallCustom) from FI.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 12.5; rv:114.0) Gecko/20100101 Firefox/114.0
This report was generated by:
http ...
show more
Triggered Cloudflare WAF (firewallCustom) from FI.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 12.5; rv:114.0) Gecko/20100101 Firefox/114.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
LRob
2025-11-07 17:18:41
UTC ·
(1 year ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇹🇷
rtbh.com.tr
2025-03-22 20:48:42
UTC ·
(1 year ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇹🇷
rtbh.com.tr
2025-03-22 00:48:42
UTC ·
(1 year ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇹🇷
rtbh.com.tr
2025-03-21 20:48:44
UTC ·
(1 year ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇩🇪
ghostwarriors
2025-03-20 16:20:10
UTC ·
(1 year ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-03-17 23:18:01
UTC ·
(1 year ago)
(mod_security) mod_security (id:211120) triggered by 194.99.27.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 17 19:17:56.548340 2025] [security2:error] [pid 12754:tid 12754] [client 194.99.27.113:36503] [ ...
show more
(mod_security) mod_security (id:211120) triggered by 194.99.27.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 17 19:17:56.548340 2025] [security2:error] [pid 12754:tid 12754] [client 194.99.27.113:36503] [client 194.99.27.113] ModSecurity: Access denied with code 403 (phase 2). Match of "endsWith /modules/paypal/express_checkout/payment.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "29"] [id "211120"] [rev "12"] [msg "COMODO WAF: Remote File Inclusion Attack||areafinancieratf.com|F|2"] [data "Matched Data: http://adguard.digital/payload/index.php? found within REQUEST_FILENAME: /wp-content/plugins/all-in-one-seo-pack/classes/aiosp.class.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "areafinancieratf.com"] [uri "/wp-content/plugins/all-in-one-seo-pack/classes/aiosp.class.php"] [unique_id "Z9itpDf7x-EIoFmi6fVMZAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
