🇺🇸
TPI-Abuse
2026-11-13 08:17:48
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 03:17:42.042228 2026] [security2:error] [pid 24051:tid 24051] [client 194.99.27.116:53953] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 03:17:42.042228 2026] [security2:error] [pid 24051:tid 24051] [client 194.99.27.116:53953] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lemoulinavent.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lemoulinavent.org"] [uri "/en/attractions/spectacles-participatifs/le-cercle-magique"] [unique_id "avbHpp7dhLvh785NIHvPswAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 11:08:31
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 06:08:27.948187 2026] [security2:error] [pid 17089:tid 17089] [client 194.99.27.116:19369] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 06:08:27.948187 2026] [security2:error] [pid 17089:tid 17089] [client 194.99.27.116:19369] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.alexgitlin.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.alexgitlin.com"] [uri "/lte.htm"] [unique_id "aunAq1kn4ZcmVf6fCjyz7AAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 16:52:09
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 12:52:03.729962 2026] [security2:error] [pid 19095:tid 19121] [client 194.99.27.116:30647] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 12:52:03.729962 2026] [security2:error] [pid 19095:tid 19121] [client 194.99.27.116:30647] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||sloveniaflyfishing.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "sloveniaflyfishing.com"] [uri "/savabo2.htm"] [unique_id "atecMxrrEJc3zn4ZwcSUpwAAAFg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-02 04:36:02
UTC ·
(4 months ago)
Sqlmap Automated SQL Injection Tool.
SQL Injection
🇯🇵
VXG-NET
2026-05-27 12:14:32
UTC ·
(5 months ago)
port=80, indicator_type=sql-injection
SQL Injection
🇫🇷
masterguru
2026-05-07 00:00:09
UTC ·
(6 months ago)
OS File Access Attempt. Matched phrase "etc/passwd" at ARGS:__waf_test__. (930120-133)
Hacking
🇨🇿
ptlab
2026-04-07 22:45:39
UTC ·
(7 months ago)
Detected wp_login attack from WP-host.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-03-25 11:37:34
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 07:37:12.103390 2026] [security2:error] [pid 16178:tid 16178] [client 194.99.27.116:45681] M ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 07:37:12.103390 2026] [security2:error] [pid 16178:tid 16178] [client 194.99.27.116:45681] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||willowbrookins.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "willowbrookins.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acPI6OKW_5aVXc279yutzAAAABE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-24 09:47:02
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 24 05:46:56.274033 2026] [security2:error] [pid 11359:tid 11359] [client 194.99.27.116:55365] M ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 24 05:46:56.274033 2026] [security2:error] [pid 11359:tid 11359] [client 194.99.27.116:55365] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||321q.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "321q.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acJdkN7QVZkNfSZDTwTYbgAAAAU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-22 14:30:16
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 10:30:08.530295 2026] [security2:error] [pid 1607:tid 1607] [client 194.99.27.116:35407] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 10:30:08.530295 2026] [security2:error] [pid 1607:tid 1607] [client 194.99.27.116:35407] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||buccinet.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "buccinet.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab_88OZ22LrmDWzAdKZStQAAABM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 11:37:48
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 07:37:42.169576 2026] [security2:error] [pid 23973:tid 23973] [client 194.99.27.116:58907] M ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 07:37:42.169576 2026] [security2:error] [pid 23973:tid 23973] [client 194.99.27.116:58907] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||horse7.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "horse7.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abvgBrMkEwOOIYRp-LQmJQAAAAU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-03-18 20:56:08
UTC ·
(7 months ago)
Web password guessing
Brute-Force
🇺🇸
TPI-Abuse
2026-03-17 10:04:54
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 17 06:04:49.939892 2026] [security2:error] [pid 24484:tid 24484] [client 194.99.27.116:24607] M ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 17 06:04:49.939892 2026] [security2:error] [pid 24484:tid 24484] [client 194.99.27.116:24607] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cvtheory.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cvtheory.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abknQVWTQj48eH0fbfhiZwAAAAc"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mind5t0rm
2026-03-13 21:05:03
UTC ·
(7 months ago)
(XMLRPC,WPLOGIN) Login failure/trigger from 194.99.27.116 (US/United States/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 194.99.27.116 - - [14/Mar/2026:04:02:47 +0700] "POST /xmlrpc.php HTTP/2.0" 403 154 "-" "Ap ...
show more
(XMLRPC,WPLOGIN) Login failure/trigger from 194.99.27.116 (US/United States/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 194.99.27.116 - - [14/Mar/2026:04:02:47 +0700] "POST /xmlrpc.php HTTP/2.0" 403 154 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
194.99.27.116 - - [14/Mar/2026:04:02:49 +0700] "GET /wp-login.php HTTP/2.0" 200 2346 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
194.99.27.116 - - [14/Mar/2026:04:04:58 +0700] "GET /wp-login.php HTTP/2.0" 200 2346 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-03-04 12:40:32
UTC ·
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 04 07:40:28.641972 2026] [security2:error] [pid 22223:tid 22223] [client 194.99.27.116:15017] M ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 04 07:40:28.641972 2026] [security2:error] [pid 22223:tid 22223] [client 194.99.27.116:15017] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||wcsystems.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "wcsystems.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aagoPHmy64s2WsuWN6-2AQAAAAU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
