🇺🇸
TPI-Abuse
2026-04-23 21:23:25
(3 months ago)
(mod_security) mod_security (id:210831) triggered by 117.139.253.91 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 117.139.253.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 23 17:23:20.179693 2026] [security2:error] [pid 3457179:tid 3457179] [client 117.139.253.91:17395] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.hiddenhistory.info|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.hiddenhistory.info"] [uri "/"] [unique_id "aeqNyMTsZga0vGWsNulsVgAAAA4"], referer: http://www.hiddenhistory.info/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-23 09:18:08
(3 months ago)
(mod_security) mod_security (id:210831) triggered by 117.139.253.91 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 117.139.253.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 23 05:18:01.698246 2026] [security2:error] [pid 2570258:tid 2570258] [client 117.139.253.91:17040] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.reyadecostarica.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.reyadecostarica.com"] [uri "/"] [unique_id "aenjyWPOuueOYaDpO836mAAAABA"], referer: http://www.reyadecostarica.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇳
ThreatBook.io
2026-01-20 23:31:19
(6 months ago)
ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/117.139.253.91
2026-01 ...
show more
ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/117.139.253.91
2026-01-20 04:50:08 /Login_files/saved_resource.html
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-09-12 14:28:27
(10 months ago)
(mod_security) mod_security (id:210350) triggered by 117.139.253.91 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 117.139.253.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 12 10:28:19.115125 2025] [security2:error] [pid 21917:tid 21917] [client 117.139.253.91:19013] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.renju.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.renju.net"] [uri "/game/101801/"] [unique_id "aMQuA4ro2Si0rsbac0AEHQAAAAE"], referer: https://www.renju.net/game/101801
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
webehostin.com
2025-08-31 06:23:31
(11 months ago)
Too Many Connections Or General Abuse
DDoS Attack
Brute-Force
🇩🇪
host.tugatech.com.pt
2025-08-21 08:32:14
(11 months ago)
(PERMBLOCK) 117.139.253.91 (CN/China/-) has had more than 4 temp blocks in the last 604800 secs; Por ...
show more
(PERMBLOCK) 117.139.253.91 (CN/China/-) has had more than 4 temp blocks in the last 604800 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:
show less
Port Scan
🇨🇳
ThreatBook.io
2025-08-07 23:01:41
(11 months ago)
ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/117.139.253.91
2025-08-07 1 ...
show more
ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/117.139.253.91
2025-08-07 16:14:54 /robots.txt
2025-08-07 22:02:33 /Login_files/saved_resource.html
2025-08-07 15:58:46 /dfdfd
show less
Web App Attack