🇺🇸
TPI-Abuse
2026-11-10 09:25:19
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 199.96.164.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:25:12.284143 2026] [security2:error] [pid 8084:tid 8084] [client 199.96.164.81:42021] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 199.96.164.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:25:12.284143 2026] [security2:error] [pid 8084:tid 8084] [client 199.96.164.81:42021] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||cortona.ws|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cortona.ws"] [uri "/mura_a_it.html"] [unique_id "avLi-BBRTVIJPrsjXfcyLQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 18:47:18
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 199.96.164.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 14:47:13.903576 2026] [security2:error] [pid 8617:tid 8617] [client 199.96.164.81:52559] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 199.96.164.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 14:47:13.903576 2026] [security2:error] [pid 8617:tid 8617] [client 199.96.164.81:52559] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jiggajones.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jiggajones.com"] [uri "/stealin_stuff.html"] [unique_id "at5OsVtLh2XwdObOlBMRzAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 09:59:30
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 199.96.164.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 05:59:22.743648 2026] [security2:error] [pid 17326:tid 17326] [client 199.96.164.81:46981] M ...
show more
(mod_security) mod_security (id:210350) triggered by 199.96.164.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 05:59:22.743648 2026] [security2:error] [pid 17326:tid 17326] [client 199.96.164.81:46981] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.hacertests.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.hacertests.com"] [uri "/examenes-101537-Nivel_de_Ingles_Ndeg2.php"] [unique_id "atyBeum5eBSKYanxKyjJ7gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-20 23:39:51
UTC ·
(3 weeks ago)
Not following 301 redirects — wasted requests | method: HEAD | path: / | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-15 14:12:38
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 199.96.164.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:12:32.745287 2026] [security2:error] [pid 29795:tid 29795] [client 199.96.164.81:63577] M ...
show more
(mod_security) mod_security (id:210350) triggered by 199.96.164.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:12:32.745287 2026] [security2:error] [pid 29795:tid 29795] [client 199.96.164.81:63577] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||kv-10.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "kv-10.com"] [uri "/seasons.htm"] [unique_id "atDfUNlmvm5jYGqA1eWljQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-15 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-14 13:50:15
UTC ·
(1 month ago)
Unauthorized VPN login attempts: 2 attempts were recorded from 199.96.164.81
2026-09-14T15:28:25+02:00 vpn Access-Reject 'wh1' station: 199.96.164.81 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
...
show more
Unauthorized VPN login attempts: 2 attempts were recorded from 199.96.164.81
2026-09-14T15:28:25+02:00 vpn Access-Reject 'wh1' station: 199.96.164.81 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-14T15:29:46+02:00 vpn Access-Reject 'testtest' station: 199.96.164.81 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇬🇧
relianoid.com
2026-09-11 18:31:05
UTC ·
(1 month ago)
POST Abuse detected by Relianoid OSS Load Balancer - relianoid.com
Web Spam
🇸🇪
OnTheEdge
2026-09-07 21:59:11
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇫🇷
dynamix
2026-08-19 11:25:18
UTC ·
(2 months ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 02:00:10
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 199.96.164.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 22:00:05.407521 2026] [security2:error] [pid 166193:tid 166193] [client 199.96.164.81:53051] ...
show more
(mod_security) mod_security (id:225170) triggered by 199.96.164.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 22:00:05.407521 2026] [security2:error] [pid 166193:tid 166193] [client 199.96.164.81:53051] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||harvestfrc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "harvestfrc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "almMpazBbw-dS_WjTOl2EgAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-16 02:27:41
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 199.96.164.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 15 22:27:34.501280 2026] [security2:error] [pid 2304992:tid 2304992] [client 199.96.164.81:4965 ...
show more
(mod_security) mod_security (id:210730) triggered by 199.96.164.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 15 22:27:34.501280 2026] [security2:error] [pid 2304992:tid 2304992] [client 199.96.164.81:49655] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Barcalounger/Images/Lectern II/Brighton Chocolate/Thumbs.db"] [unique_id "aeBJFkkUJfEnE_OxARWWFgAAABg"], referer: https://vitalitywebb.com/backstore/Barcalounger/Images/Lectern%20II/Brighton%20Chocolate/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nodepile
2026-01-12 23:10:51
UTC ·
(9 months ago)
Requests denied due to proxy/VPN risk (tenant=82 method=GET path=/brands/diode-dynamics/lamps/elite-fog-lamps-for-2021-2023-ford-f-150-pair.html ua='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.1926.18 ...
show more
Requests denied due to proxy/VPN risk (tenant=82 method=GET path=/brands/diode-dynamics/lamps/elite-fog-lamps-for-2021-2023-ford-f-150-pair.html ua='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.1926.188 Safari/537.36')
show less
Open Proxy
VPN IP
🇨🇭
backslash
2026-01-06 01:50:29
UTC ·
(10 months ago)
block ruleset 798ECF92F12ADC636D3520C2890AF17ADEFDE3BE
Bad Web Bot
🇺🇸
nodepile
2025-12-29 12:54:55
UTC ·
(10 months ago)
Requests denied due to proxy/VPN risk (tenant=82 method=GET path=/umnitza-predator-orion™-application-with-remote-p-5680.html ua='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.727.178 Safari/537.36')
Open Proxy
VPN IP
