🇺🇸
TPI-Abuse
2026-11-15 19:11:21
UTC ·
(51 minutes ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 14:11:16.365393 2026] [security2:error] [pid 5535:tid 5535] [client 194.99.27.119:44863] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 14:11:16.365393 2026] [security2:error] [pid 5535:tid 5535] [client 194.99.27.119:44863] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||modmove.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "modmove.com"] [uri "/festivals/the-2023-saxo-scandinavian-film-festival-programme-has-been-revealed/"] [unique_id "avoD1D6AMqHdwC9GqkcjEAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 00:49:28
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 19:49:21.385287 2026] [security2:error] [pid 4042:tid 4042] [client 194.99.27.119:39621] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 19:49:21.385287 2026] [security2:error] [pid 4042:tid 4042] [client 194.99.27.119:39621] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.lasertherapyoc.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.lasertherapyoc.com"] [uri "/faq/"] [unique_id "aukvkbygLSPGr61r_465-AAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 06:51:23
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 02:51:20.314776 2026] [security2:error] [pid 9427:tid 9427] [client 194.99.27.119:49013] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 02:51:20.314776 2026] [security2:error] [pid 9427:tid 9427] [client 194.99.27.119:49013] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||vitality-web.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "vitality-web.com"] [uri "/Stressless-Chair/Stressless-Ambassador-Large-Consul-Batick-Latte-Leather-Recliner.htm"] [unique_id "auWP6DHukYkMI5Bc2bZVMwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 00:09:46
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 20:09:37.996326 2026] [security2:error] [pid 18483:tid 18483] [client 194.99.27.119:17163] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 20:09:37.996326 2026] [security2:error] [pid 18483:tid 18483] [client 194.99.27.119:17163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ielts-english.info|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ielts-english.info"] [uri "/blog/"] [unique_id "auE9QbElYhkKLHNA_Ac-KgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-06 01:27:30
UTC ·
(1 month ago)
Web exploit attempt | method: GET | path: /wp-json/wp/v2/users | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-07-31 12:37:59
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 08:37:51.817695 2026] [security2:error] [pid 244265:tid 244265] [client 194.99.27.119:35231] ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 08:37:51.817695 2026] [security2:error] [pid 244265:tid 244265] [client 194.99.27.119:35231] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nothotmail.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nothotmail.org"] [uri "/wp-json/wp/v2/users"] [unique_id "amyXH3pjv5cChSFQumzNoAAAABE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-26 10:27:20
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 06:27:12.537449 2026] [security2:error] [pid 4947:tid 4947] [client 194.99.27.119:29427] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 06:27:12.537449 2026] [security2:error] [pid 4947:tid 4947] [client 194.99.27.119:29427] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||puoci.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "puoci.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amXhAHFX772nAqgBdcNodQAAABs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
DRI
2026-07-26 01:36:23
UTC ·
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇺🇸
TPI-Abuse
2026-07-25 22:36:07
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 18:35:58.942330 2026] [security2:error] [pid 946815:tid 946815] [client 194.99.27.119:38729] ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 18:35:58.942330 2026] [security2:error] [pid 946815:tid 946815] [client 194.99.27.119:38729] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||calfirstrealty.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "calfirstrealty.net"] [uri "/wp-json/wp/v2/users"] [unique_id "amU6TlVPhBy7ecBTxWK8pQAAABQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-24 21:12:48
UTC ·
(3 months ago)
Fail2ban filtered
...
Web App Attack
🇺🇸
TPI-Abuse
2026-07-15 15:25:31
UTC ·
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 11:25:26.292066 2026] [security2:error] [pid 23129:tid 23129] [client 194.99.27.119:24549] M ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 11:25:26.292066 2026] [security2:error] [pid 23129:tid 23129] [client 194.99.27.119:24549] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||purebinary.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "purebinary.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alemZiVUbJuF0qaieO2ZogAAAB0"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-05-04 17:30:02
UTC ·
(6 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇩🇪
stinpriza
2026-04-25 05:17:52
UTC ·
(6 months ago)
Web App Attack
Web App Attack
🇳🇱
maxxsense
2026-03-21 17:12:16
UTC ·
(7 months ago)
(wordpress) Failed wordpress login from 194.99.27.119 (US/United States/-)
Brute-Force
🇫🇷
ingroscart.it
2026-03-21 14:15:40
UTC ·
(7 months ago)
(mod_security) mod_security triggered on hostname [redacted] 194.99.27.119 (US/United States/-)
SQL Injection
