🇺🇸
TPI-Abuse
2026-11-06 06:41:07
UTC ·
(14 hours ago)
(mod_security) mod_security (id:225170) triggered by 27.123.253.205 (27-123-253-205-mcnbd.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 01:40:59.739993 2026] [security2:error] [pid 32160:tid 32160] [clien ...
show more
(mod_security) mod_security (id:225170) triggered by 27.123.253.205 (27-123-253-205-mcnbd.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 01:40:59.739993 2026] [security2:error] [pid 32160:tid 32160] [client 27.123.253.205:51482] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||realdesigninterior.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "realdesigninterior.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au12eycsnFbwrMSBkBngHwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-11-06 05:23:44
UTC ·
(16 hours ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: crowdsecurity/http-probing.
Bad Web Bot
Web App Attack
🇨🇿
lp
2026-11-01 06:33:24
UTC ·
(5 days ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 27.123.253.205
2026-11-01T07:24:07+0100 vpn Access-Reject station: 27.123.253.205
Brute-Force
Web App Attack
🇩🇪
klaus_ph
2026-10-30 00:57:07
UTC ·
(1 week ago)
[Thu Oct 29 23:22:32.123932 2026] [ssl:info] [pid 1087936] [client 27.123.253.205:48426] AH01964: Connection to child 2 established (server fit.vufindnet.de:443)
...
Hacking
🇺🇸
TPI-Abuse
2026-10-26 13:21:37
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 27.123.253.205 (27-123-253-205-mcnbd.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 09:21:29.290366 2026] [security2:error] [pid 21571:tid 21571] [clien ...
show more
(mod_security) mod_security (id:225170) triggered by 27.123.253.205 (27-123-253-205-mcnbd.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 09:21:29.290366 2026] [security2:error] [pid 21571:tid 21571] [client 27.123.253.205:58058] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||brazilianbottom.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "brazilianbottom.com"] [uri "/wp-json/wp/v2/users"] [unique_id "at9T2Yx9pB72-NOPOE5ndAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-10-26 01:17:19
UTC ·
(1 week ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=44&topics%5B3%5D=35&topics%5B4%5D=29&topics%5B5%5D=49 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=44&topics%5B3%5D=35&topics%5B4%5D=29&topics%5B5%5D=49 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0")
show less
DDoS Attack
Bad Web Bot
2026-10-19 03:21:33
UTC ·
(2 weeks ago)
apache vulnerability scan
Web App Attack
🇵🇱
bmino.pl
2026-10-15 15:16:38
UTC ·
(3 weeks ago)
Autoban IP(2): 27.123.253.205 - Hostname: Kazi Sazzad Hossain T/A Millennium Computers \u0026 Networking - City: Dhaka - Country: Bangladesh - Organization: Millennium Computers \u0026 Networking - Reason: GET /?p=nik3mva29017fmmgebb HTTP/1.1
Web App Attack
🇺🇸
kosada.com
2026-10-08 16:55:43
UTC ·
(4 weeks ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=42&topics%5B2%5D=79&topics%5B3%5D=67&topics%5B4%5D=28 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/6 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=42&topics%5B2%5D=79&topics%5B3%5D=67&topics%5B4%5D=28 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0.1 Safari/605.1.15")
show less
DDoS Attack
Bad Web Bot
🇷🇺
AbuseIPDB informer
2026-10-08 10:38:42
UTC ·
(4 weeks ago)
nfdump top talker: 27.123.253.205 | first seen 2026-10-08 13:38:42.176 | duration 00:00:00.066 | flows=1 | packets=53196 | bytes=37.6 M | pps=805 | bps=4.5 M | bpp=705 | proto=any
DDoS Attack
Port Scan
Exploited Host
🇩🇪
Packets-Decreaser.NET
2026-10-07 06:35:48
UTC ·
(4 weeks ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇩🇪
Packets-Decreaser.NET
2026-10-05 21:24:21
UTC ·
(1 month ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
TPI-Abuse
2026-10-02 18:02:13
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 27.123.253.205 (27-123-253-205-mcnbd.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 14:02:08.182174 2026] [security2:error] [pid 27660:tid 27660] [clien ...
show more
(mod_security) mod_security (id:210350) triggered by 27.123.253.205 (27-123-253-205-mcnbd.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 14:02:08.182174 2026] [security2:error] [pid 27660:tid 27660] [client 27.123.253.205:40344] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||americanflagcards.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "americanflagcards.com"] [uri "/"] [unique_id "ar_xoMzXar1_XURoTTyqDgAAAAU"], referer: https://automaticbacklinkcreator.shop/dir/trusted-backlink-services-8593
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 06:57:50
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 27.123.253.205 (27-123-253-205-mcnbd.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 02:57:44.763155 2026] [security2:error] [pid 11910:tid 11910] [clien ...
show more
(mod_security) mod_security (id:210350) triggered by 27.123.253.205 (27-123-253-205-mcnbd.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 02:57:44.763155 2026] [security2:error] [pid 11910:tid 11910] [client 27.123.253.205:49218] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||kreweofhyatt.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "kreweofhyatt.com"] [uri "/"] [unique_id "ar9V6LWQ6-IenNMC6bJBcgAAACI"], referer: https://seoserviceslinkbuilding.space/dir/ethical-link-building-services-115992
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-09-30 13:49:09
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Bad Web Bot
