🇪🇸
librebit
2026-11-15 00:21:14
UTC ·
(44 minutes ago)
Brute force
Brute-Force
🇺🇸
Zandro
2026-11-14 20:00:14
UTC ·
(5 hours ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-14 09:47:26
UTC ·
(15 hours ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:47:21.892421 2026] [security2:error] [pid 31587:tid 31587] [client 194.99.27.35:11141] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:47:21.892421 2026] [security2:error] [pid 31587:tid 31587] [client 194.99.27.35:11141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.americanureport.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.americanureport.com"] [uri "/au-in-the-news-archives/aus-washington-college-of-law-is-2nd-most-liberal-in-us/"] [unique_id "avguKaOpYipv0c4XCZJksQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-28 05:10:56
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 28 01:10:52.178644 2026] [security2:error] [pid 368771:tid 368771] [client 194.99.27.35:36677] M ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 28 01:10:52.178644 2026] [security2:error] [pid 368771:tid 368771] [client 194.99.27.35:36677] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rogerg.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rogerg.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amg53Fd37qoJ1ZiK2LTGUQAAAAo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-25 22:21:11
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 18:21:04.524639 2026] [security2:error] [pid 1895477:tid 1895477] [client 194.99.27.35:35687] ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 18:21:04.524639 2026] [security2:error] [pid 1895477:tid 1895477] [client 194.99.27.35:35687] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||calveley.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "calveley.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amU20AI_Pi5S_i0etY00uQAAAAM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Lino Project
2026-05-17 16:04:46
UTC ·
(5 months ago)
194.99.27.35 - - [17/May/2026:18:04:46 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3987 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
...
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-19 23:30:36
UTC ·
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 19 18:30:31.598623 2026] [security2:error] [pid 22743:tid 22743] [client 194.99.27.35:59099] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 19 18:30:31.598623 2026] [security2:error] [pid 22743:tid 22743] [client 194.99.27.35:59099] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.zezel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.zezel.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aW6-l8x8AznhFmzEhoRqFgAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-15 15:58:03
UTC ·
(11 months ago)
(mod_security) mod_security (id:210350) triggered by 194.99.27.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 15 10:57:57.322544 2025] [security2:error] [pid 31593:tid 31593] [client 194.99.27.35:19113] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 194.99.27.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 15 10:57:57.322544 2025] [security2:error] [pid 31593:tid 31593] [client 194.99.27.35:19113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||abbysue.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "abbysue.com"] [uri "/"] [unique_id "aRijBXzUwEqvTTy9m5rRWwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
polycoda
2025-09-22 11:01:18
UTC ·
(1 year ago)
📄 Probes for wp-login.php and other inexistent URLs
Hacking
Web App Attack
🇫🇷
Sklurk
2025-09-21 19:26:37
UTC ·
(1 year ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2025-09-21 03:08:34
UTC ·
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 194.99.27.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 20 23:08:27.214016 2025] [security2:error] [pid 10850:tid 10850] [client 194.99.27.35:50027] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 194.99.27.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 20 23:08:27.214016 2025] [security2:error] [pid 10850:tid 10850] [client 194.99.27.35:50027] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||barigby.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "barigby.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aM9sK_f-6rZIIpGsatzl6gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
OnTheEdge
2025-03-19 00:59:32
UTC ·
(1 year ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇸🇪
OnTheEdge
2025-02-15 01:37:00
UTC ·
(1 year ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇿
lp
2025-02-07 13:22:38
UTC ·
(1 year ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 194.99.27.35
2025-02-07T13:15:55+01:00 vpn Access-Reject 'Abnormals' station: 194.99.27.35 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacte ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 194.99.27.35
2025-02-07T13:15:55+01:00 vpn Access-Reject 'Abnormals' station: 194.99.27.35 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
