🇺🇸
TPI-Abuse
2026-05-15 23:13:44
(2 weeks ago)
(mod_security) mod_security (id:211030) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:211030) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 19:13:37.634066 2026] [security2:error] [pid 15658:tid 15658] [client 94.154.127.47:38275] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at ARGS. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "17"] [id "211030"] [rev "3"] [msg "COMODO WAF: LDAP Injection Attack||www.genesis-castle.com|F|2"] [data "Matched Data: ('~'||( found within ARGS: 0"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "www.genesis-castle.com"] [uri "/gallery/index.php"] [unique_id "ageoobjgCaKXzFRLA0WAbAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-02-28 09:40:45
(3 months ago)
Failed Wordpress login
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-02-27 01:35:10
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 26 20:35:03.393172 2026] [security2:error] [pid 9929:tid 9929] [client 94.154.127.47:61481] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lewpratt.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lewpratt.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaD0xzxhUkuFeOtOHuPkNQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-25 20:51:07
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 25 15:51:02.625654 2026] [security2:error] [pid 23681:tid 23681] [client 94.154.127.47:28033] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||avvmarchetticollini.it|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "avvmarchetticollini.it"] [uri "/wp-json/wp/v2/users"] [unique_id "aZ9gtouTpmHE2Ld6GaWpVAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-24 21:24:51
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 24 16:24:41.431619 2026] [security2:error] [pid 15063:tid 15097] [client 94.154.127.47:24487] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||abusaimeh.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "abusaimeh.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZ4XGXZaNhG2upVteYCZbQAAARc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-23 22:29:11
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 23 17:29:06.584749 2026] [security2:error] [pid 6783:tid 6783] [client 94.154.127.47:35499] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||thinksite.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "thinksite.net"] [uri "/"] [unique_id "aZzUsr0SQyJIMIpC8Pu91wAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
EchoGuard
2026-02-15 14:57:37
(3 months ago)
FortiGate SSL VPN login failures
VPN IP
Brute-Force
🇺🇸
fbarela
2026-02-12 19:00:11
(3 months ago)
FortiGate SSL VPN login failures.
Hacking
Brute-Force
🇮🇩
Burayot
2025-12-20 06:06:36
(5 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 94.154.127.47 (GB/United Kingdom/-) ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 94.154.127.47 (GB/United Kingdom/-): 1 in the last 3600 secs
show less
Web App Attack
2025-12-18 17:51:21
(5 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇩🇪
Packets-Decreaser.NET
2025-12-10 14:34:43
(5 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
TPI-Abuse
2025-09-11 17:43:59
(8 months ago)
(mod_security) mod_security (id:210350) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 11 13:43:52.341326 2025] [security2:error] [pid 5397:tid 5397] [client 94.154.127.47:21993] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.wilburmanagementgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.wilburmanagementgroup.com"] [uri "/"] [unique_id "aMMKWNp_ptU5_aThYjzLTQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-06 19:17:27
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 06 15:17:20.754430 2025] [security2:error] [pid 4612:tid 4612] [client 94.154.127.47:34331] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Catnapper/images/Omni/Thumbs.db"] [unique_id "aLyIwEtcR27QbhwYQATk8gAAAAc"], referer: https://vitalitywebb.com/backstore/Catnapper/images/Omni/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2025-07-04 04:00:33
(11 months ago)
Bad Web Bot
🇺🇸
TPI-Abuse
2025-06-21 02:33:56
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 94.154.127.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 20 22:33:50.790633 2025] [security2:error] [pid 3113421:tid 3113421] [client 94.154.127.47:51653] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Golden-Technologies/pics/Golden Technologies 2009 Marketing CD/Lift Chairs/Lifestyle/Thumbs.db"] [unique_id "aFYaDp5WMbJNHp-XZV7GPAAAAAw"], referer: https://vitalitywebb.com/backstore/Golden-Technologies/pics/Golden%20Technologies%202009%20Marketing%20CD/Lift%20Chairs/Lifestyle/
show less
Brute-Force
Bad Web Bot
Web App Attack