🇺🇸
TPI-Abuse
2026-10-18 01:47:49
(1 hour ago)
(mod_security) mod_security (id:210740) triggered by 5.42.127.131 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210740) triggered by 5.42.127.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:47:45.286703 2026] [security2:error] [pid 8839:tid 8839] [client 5.42.127.131:41700] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy||intelligent-design.net:443|F|4"] [data "/Proxy-Connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "intelligent-design.net"] [uri "/"] [unique_id "atQlQdaIAdqv2D2WqCU0ygAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 17:00:45
(10 hours ago)
(mod_security) mod_security (id:210740) triggered by 5.42.127.131 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210740) triggered by 5.42.127.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 13:00:41.239431 2026] [security2:error] [pid 3227:tid 3227] [client 5.42.127.131:54002] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy||chyps.com:443|F|4"] [data "/Proxy-Connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "chyps.com"] [uri "/"] [unique_id "atOpuXVBvckrM_qvDJpzYQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 12:25:12
(2 days ago)
(mod_security) mod_security (id:217210) triggered by 5.42.127.131 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:217210) triggered by 5.42.127.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 08:25:03.334704 2026] [security2:error] [pid 4724:tid 4724] [client 5.42.127.131:57372] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||www.worthhistory.org:443|F|4"] [data "CONNECT www.worthhistory.org:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.worthhistory.org"] [uri "/"] [unique_id "atDGH8PZm7mlj-B-FgWUMQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 11:22:40
(2 days ago)
(mod_security) mod_security (id:210740) triggered by 5.42.127.131 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210740) triggered by 5.42.127.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 07:22:36.248508 2026] [security2:error] [pid 30784:tid 30784] [client 5.42.127.131:40290] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy||globalmappinginc.com:443|F|4"] [data "/Proxy-Connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "globalmappinginc.com"] [uri "/"] [unique_id "atC3fESww07uXR8YmjimWAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-14 07:16:30
(3 days ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 08:52:00
(5 days ago)
(mod_security) mod_security (id:210740) triggered by 5.42.127.131 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210740) triggered by 5.42.127.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 04:51:53.243115 2026] [security2:error] [pid 2931:tid 2931] [client 5.42.127.131:40996] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy||art.mavikalem.org:443|F|4"] [data "/Proxy-Connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "art.mavikalem.org"] [uri "/"] [unique_id "asyfqen4ouPN4wBMHfuvKgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Packets-Decreaser.NET
2026-10-11 23:32:38
(6 days ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
2026-10-10 18:31:22
(1 week ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 02:23:37
(1 week ago)
(mod_security) mod_security (id:217210) triggered by 5.42.127.131 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:217210) triggered by 5.42.127.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:23:29.452421 2026] [security2:error] [pid 14044:tid 14044] [client 5.42.127.131:52624] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||mroxygen.org:443|F|4"] [data "CONNECT mroxygen.org:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "mroxygen.org"] [uri "/"] [unique_id "ashQIQyfRBxRuBEc2jYGhAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-08 19:28:25
(1 week ago)
Not following 301 redirects — wasted requests | method: GET | path: https://copinesdebonsplans.fr/av ...
show more
Not following 301 redirects — wasted requests | method: GET | path: https://copinesdebonsplans.fr/avis-modz/ | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 | 2026-10-08 19:28 UTC
show less
Bad Web Bot
🇩🇪
Packets-Decreaser.NET
2026-10-08 06:05:48
(1 week ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
dot.mg
2026-10-07 18:37:16
(1 week ago)
Impersonating Good bots
Bad Web Bot
2026-10-05 00:52:26
(1 week ago)
IP matched detection query more than 2 hosts and only bad rq long ban.
Brute-Force
Web App Attack
Hacking
2026-10-04 20:45:22
(1 week ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇩🇪
Packets-Decreaser.NET
2026-10-03 00:49:17
(2 weeks ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
