🇺🇸
TPI-Abuse
2026-11-15 23:20:35
UTC ·
(15 minutes ago)
(mod_security) mod_security (id:210350) triggered by 199.96.166.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 18:20:27.232949 2026] [security2:error] [pid 19120:tid 19170] [client 199.96.166.37:64237] M ...
show more
(mod_security) mod_security (id:210350) triggered by 199.96.166.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 18:20:27.232949 2026] [security2:error] [pid 19120:tid 19170] [client 199.96.166.37:64237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cargomarexpress.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cargomarexpress.com"] [uri "/product/nnamesmanshipf3244203"] [unique_id "avo-O_qZ8YPurGDhFZNUGAAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 19:19:27
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 199.96.166.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 14:19:22.898127 2026] [security2:error] [pid 21232:tid 21232] [client 199.96.166.37:11411] M ...
show more
(mod_security) mod_security (id:210350) triggered by 199.96.166.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 14:19:22.898127 2026] [security2:error] [pid 21232:tid 21232] [client 199.96.166.37:11411] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ofertasdetrabajosyempleos.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ofertasdetrabajosyempleos.com"] [uri "/panama/buscador-ventas-david.php"] [unique_id "avi0OsFtXW-hp6iTDSmX6wAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 02:36:33
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 199.96.166.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 21:36:25.796273 2026] [security2:error] [pid 1210:tid 1210] [client 199.96.166.37:44159] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 199.96.166.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 21:36:25.796273 2026] [security2:error] [pid 1210:tid 1210] [client 199.96.166.37:44159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||alexgitlin.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "alexgitlin.com"] [uri "/npp/snafu.htm"] [unique_id "auf3KR7M0Ky6JMuL0KEmEAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 12:29:28
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 199.96.166.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 08:29:22.577180 2026] [security2:error] [pid 32289:tid 32289] [client 199.96.166.37:53807] M ...
show more
(mod_security) mod_security (id:210730) triggered by 199.96.166.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 08:29:22.577180 2026] [security2:error] [pid 32289:tid 32289] [client 199.96.166.37:53807] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Barcalounger/Images/Lectern II/Savannah Whiskey/Thumbs.db"] [unique_id "auXfIpr_R1T_BhgkD03rygAAAAM"], referer: https://vitalitywebb.com/backstore/Barcalounger/Images/Lectern%20II/Savannah%20Whiskey/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
relianoid.com
2026-09-09 09:55:13
UTC ·
(2 months ago)
POST Abuse detected by Relianoid OSS Load Balancer - relianoid.com
Web Spam
🇮🇩
bps-statistics
2026-08-11 15:00:35
UTC ·
(3 months ago)
WP Admin Scan Activities: "2026-08-11T22:00:35.752+07:00" "/wp-admin/" "199.96.166.37" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15"
Web App Attack
🇮🇩
bps-statistics
2026-07-31 16:40:12
UTC ·
(3 months ago)
WP Admin Scan Activities: "2026-07-31T23:40:12.973+07:00" "/wp-admin/" "199.96.166.37" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0.0) Gecko/20100101 Firefox/128.0.0"
Web App Attack
🇺🇸
TPI-Abuse
2026-07-01 07:49:29
UTC ·
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 199.96.166.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 03:49:24.981206 2026] [security2:error] [pid 16323:tid 16323] [client 199.96.166.37:27677] M ...
show more
(mod_security) mod_security (id:225170) triggered by 199.96.166.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 03:49:24.981206 2026] [security2:error] [pid 16323:tid 16323] [client 199.96.166.37:27677] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||michaelmoorefield.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "michaelmoorefield.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akTGhLWEeaOUMS8-PztFiwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2025-12-23 11:20:06
UTC ·
(10 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 199.96.166.37 (US/United States/-): 1 in the last 3600 secs (0-197)
Hacking
2025-12-01 21:38:46
UTC ·
(11 months ago)
IM360 WAF: Attempt to upload malware
Hacking
🇮🇳
PortArmor.net
2025-12-01 03:40:40
UTC ·
(11 months ago)
Connection closed by 199.96.166.37 [preauth] or weird packet
Brute-Force
SSH
2025-10-23 06:59:51
UTC ·
(1 year ago)
IM360 WAF: Attempt to upload malware
Hacking
🇵🇱
sefinek.net
2025-07-30 10:33:16
UTC ·
(1 year ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:114.0) Gecko/20100101 Firefox/114.0
This report was generated by:
https://g ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:114.0) Gecko/20100101 Firefox/114.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
