🇺🇸
TPI-Abuse
2026-11-14 13:56:31
UTC ·
(6 hours ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 08:56:25.552574 2026] [security2:error] [pid 26077:tid 26077] [client 194.99.27.28:30953] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 08:56:25.552574 2026] [security2:error] [pid 26077:tid 26077] [client 194.99.27.28:30953] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jerusalem-temple-today.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jerusalem-temple-today.com"] [uri "/for/posting.php"] [unique_id "avhoicuB0d4MJyE1pycCXwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-11 20:00:14
UTC ·
(3 days ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-11 16:38:54
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 11:38:49.257113 2026] [security2:error] [pid 28264:tid 28264] [client 194.99.27.28:22857] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 11:38:49.257113 2026] [security2:error] [pid 28264:tid 28264] [client 194.99.27.28:22857] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "avSaGSfSaMf52YhfNZJsswAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 12:17:43
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 07:17:39.134252 2026] [security2:error] [pid 30858:tid 30858] [client 194.99.27.28:48117] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 07:17:39.134252 2026] [security2:error] [pid 30858:tid 30858] [client 194.99.27.28:48117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arapi.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arapi.org"] [uri "/milla-kasinopeleilla-on-kaikki-kasinot-parhaat-mahdollisuudet/"] [unique_id "au3FY3d8zEldzeJgrnSm0wAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 03:22:38
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 22:22:35.672089 2026] [security2:error] [pid 2429234:tid 2429258] [client 194.99.27.28:57967] ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 22:22:35.672089 2026] [security2:error] [pid 2429234:tid 2429258] [client 194.99.27.28:57967] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||fiefblondel.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "fiefblondel.com"] [uri "/Contact.html"] [unique_id "aulTe5ZoBIUv4nL0uM5u1wAAAFY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 20:00:10
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 15:00:05.176752 2026] [security2:error] [pid 30403:tid 30403] [client 194.99.27.28:23551] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 15:00:05.176752 2026] [security2:error] [pid 30403:tid 30403] [client 194.99.27.28:23551] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||painting-with-numbers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "painting-with-numbers.com"] [uri "/the-book/the-book/"] [unique_id "aujrxfqojW8sX1us9qTYjgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 11:10:17
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 07:10:12.777695 2026] [security2:error] [pid 373248:tid 373248] [client 194.99.27.28:61435] M ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 07:10:12.777695 2026] [security2:error] [pid 373248:tid 373248] [client 194.99.27.28:61435] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.register-yacht-cyprus.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.register-yacht-cyprus.com"] [uri "/sv/"] [unique_id "auXMlFnEveY_dp7F-wBNAgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 22:30:45
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 18:30:38.379945 2026] [security2:error] [pid 20161:tid 20193] [client 194.99.27.28:24449] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 18:30:38.379945 2026] [security2:error] [pid 20161:tid 20193] [client 194.99.27.28:24449] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||alicefaye.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "alicefaye.com"] [uri "/"] [unique_id "auEmDrdsxAt01zVkqC39agAAARE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-30 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇸🇪
OnTheEdge
2026-09-30 00:07:34
UTC ·
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇺🇸
SX Communications
2026-08-25 03:08:04
UTC ·
(2 months ago)
Blocked abusive HTTP application-layer DoS / botnet traffic from 194.99.27.28: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
octageeks.com
2026-05-06 04:07:28
UTC ·
(6 months ago)
Wordpress malicious attack:[octaxmlrpc]
Web App Attack
🇩🇪
ghostwarriors
2026-05-05 19:21:12
UTC ·
(6 months ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-04-24 20:15:08
UTC ·
(6 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-25 17:16:31
UTC ·
(8 months ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 25 12:16:25.767724 2026] [security2:error] [pid 27695:tid 27695] [client 194.99.27.28:47155] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 25 12:16:25.767724 2026] [security2:error] [pid 27695:tid 27695] [client 194.99.27.28:47155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||tomthomasplumbing.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "tomthomasplumbing.com"] [uri "/"] [unique_id "aZ8uaRbXPNIxYnM8BHo_JgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
