🇺🇸
TPI-Abuse
2026-11-14 23:59:14
UTC ·
(7 minutes ago)
(mod_security) mod_security (id:210350) triggered by 185.94.33.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 18:59:09.249165 2026] [security2:error] [pid 1876850:tid 1876850] [client 185.94.33.136:5647 ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.33.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 18:59:09.249165 2026] [security2:error] [pid 1876850:tid 1876850] [client 185.94.33.136:56473] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jmwilliamsrealty.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jmwilliamsrealty.com"] [uri "/blog/exploring-farmland-valuation-and-investment-strategies"] [unique_id "avj1zbxkCUvnBqWzO4eY2gAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-14 04:00:14
UTC ·
(20 hours ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-13 15:31:30
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 185.94.33.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:31:23.199565 2026] [security2:error] [pid 10381:tid 10381] [client 185.94.33.136:21817] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.33.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:31:23.199565 2026] [security2:error] [pid 10381:tid 10381] [client 185.94.33.136:21817] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jerusalem-temple-today.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jerusalem-temple-today.com"] [uri "/for/viewtopic.php"] [unique_id "avctS7ySFwtAyndp3HKNuAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 22:31:32
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 185.94.33.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 17:31:25.044943 2026] [security2:error] [pid 10306:tid 10306] [client 185.94.33.136:61693] M ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.33.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 17:31:25.044943 2026] [security2:error] [pid 10306:tid 10306] [client 185.94.33.136:61693] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2014/08/25/syria-fight-the-inertia-of-no-good-options-policymaking/"] [unique_id "au5VPVDyTaWnFictB-LZrgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 15:51:08
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 185.94.33.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 11:51:00.746288 2026] [security2:error] [pid 417:tid 417] [client 185.94.33.136:43309] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 185.94.33.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 11:51:00.746288 2026] [security2:error] [pid 417:tid 417] [client 185.94.33.136:43309] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/tag/sony/"] [unique_id "auNrZMZGm0GMY1rnac95dwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-10-15 20:22:51
UTC ·
(4 weeks ago)
HTTP application-layer DoS / botnet traffic from 185.94.33.136: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇨🇿
Countryman
2026-09-14 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇭
SOC [GOLINE SA]
2026-09-10 22:01:00
UTC ·
(2 months ago)
[RoutePulse | 2026-09-10T22:01:00Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 185.94.33.136 · AS59651 Alex Largman · Russia
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — shunned by the FTD's own ...
show more
[RoutePulse | 2026-09-10T22:01:00Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 185.94.33.136 · AS59651 Alex Largman · Russia
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — shunned by the FTD's own threat detection (adopted by RoutePulse: TTL, strike, diary)
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
Brute-Force
Hacking
🇫🇷
Tilellit.PRO
2026-07-22 03:35:52
UTC ·
(3 months ago)
WP Armour Plugin detection
Web Spam
Brute-Force
🇫🇮
JimArchon72
2026-05-25 03:15:01
UTC ·
(5 months ago)
2026/05/25 03:11:58 "GET /wp-login.php?action=register HTTP/1.1"
Web App Attack
🇩🇪
Packets-Decreaser.NET
2025-12-10 14:37:38
UTC ·
(11 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇨🇭
backslash
2025-10-16 23:40:31
UTC ·
(1 year ago)
block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8
Bad Web Bot
🇨🇭
backslash
2025-03-25 21:45:05
UTC ·
(1 year ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇦🇺
advena
2024-12-27 23:16:06
UTC ·
(1 year ago)
185.94.33.136 (AS51765 CREANOVA-AS Oy Creanova Hosting Solutions Ltd.) was intercepted at 2024-12-27T23:12:33Z after violating WAF directive: 874a3e315c344b1281ad4f00046aab6f. Pre-cautionary/corrective action applied: block.
Web Spam
Hacking
Brute-Force
Web App Attack
🇺🇸
nationaleventpros.com
2024-08-15 16:11:56
UTC ·
(2 years ago)
WordPress login attempt
Brute-Force
