🇺🇸
TPI-Abuse
2026-11-10 11:56:27
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 188.253.221.233 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:56:22.730097 2026] [security2:error] [pid 27974:tid 27974] [client 188.253.221.233:8071 ...
show more
(mod_security) mod_security (id:225170) triggered by 188.253.221.233 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:56:22.730097 2026] [security2:error] [pid 27974:tid 27974] [client 188.253.221.233:8071] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||superlamb.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "superlamb.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avMGZoQJuxSfeuY6a45_SQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-10-27 17:10:07
UTC ·
(2 weeks ago)
HTTP application-layer DoS / botnet traffic from 188.253.221.233: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
RAP
2026-10-24 08:38:53
UTC ·
(2 weeks ago)
2026-10-24 08:38:53 UTC Unauthorized activity to TCP port 23. Telnet
Port Scan
🇺🇸
kosada.com
2026-10-08 08:21:24
UTC ·
(1 month ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=47&topics%5B3%5D=48&topics%5B4%5D=64&topics%5B5%5D=43 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/6 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=47&topics%5B3%5D=48&topics%5B4%5D=64&topics%5B5%5D=43 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15")
show less
DDoS Attack
Bad Web Bot
🇬🇧
tpguy825
2026-09-22 13:01:07
UTC ·
(1 month ago)
SSH bruteforce from 188.253.221.233 port 5124, stuck in tarpit for 20.012 secs
Hacking
Brute-Force
SSH
2026-09-22 12:43:47
UTC ·
(1 month ago)
denied Telnet access attempt. destination port 23.
Port Scan
Brute-Force
🇩🇰
powerhostingdk
2026-09-15 07:49:16
UTC ·
(1 month ago)
[mailserver] CrowdSec detected crowdsecurity/postscreen-rbl (1 events). Automated abuse report.
Email Spam
Brute-Force
🇺🇸
kosada.com
2026-08-25 03:20:10
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇵🇱
mkey
2026-08-16 21:55:02
UTC ·
(2 months ago)
Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_MULTIPORT | PORTS=22,23 | HITS=2 | IPSET=ADD | FIRST=2026-08-16 23:52:11 | LAST=2026-08-16 23:52:11. Last seen 2026-08-16 23:52:11.
Port Scan
🇺🇸
kosada.com
2026-08-01 05:50:23
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-26 03:52:57
UTC ·
(5 months ago)
(mod_security) mod_security (id:240335) triggered by 188.253.221.233 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 23:52:52.757483 2026] [security2:error] [pid 19400:tid 19400] [client 188.253.221.233:9224 ...
show more
(mod_security) mod_security (id:240335) triggered by 188.253.221.233 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 23:52:52.757483 2026] [security2:error] [pid 19400:tid 19400] [client 188.253.221.233:9224] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 188.253.221.233 (+1 hits since last alert)|nordicbuilders.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nordicbuilders.net"] [uri "/xmlrpc.php"] [unique_id "ahUZFEADb6IwM0fZ2aabaQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
WeekendWeb
2026-05-26 02:07:24
UTC ·
(5 months ago)
Wordpress Vunerability attack
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 21:22:37
UTC ·
(5 months ago)
(mod_security) mod_security (id:240335) triggered by 188.253.221.233 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 17:22:33.473257 2026] [security2:error] [pid 31177:tid 31197] [client 188.253.221.233:1536 ...
show more
(mod_security) mod_security (id:240335) triggered by 188.253.221.233 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 17:22:33.473257 2026] [security2:error] [pid 31177:tid 31197] [client 188.253.221.233:15369] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 188.253.221.233 (+1 hits since last alert)|piazza9.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "piazza9.com"] [uri "/xmlrpc.php"] [unique_id "ahS9maSw64nfTkZUGreexQAAAVI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 15:41:39
UTC ·
(5 months ago)
(mod_security) mod_security (id:240335) triggered by 188.253.221.233 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 11:41:31.986427 2026] [security2:error] [pid 8787:tid 8787] [client 188.253.221.233:14074] ...
show more
(mod_security) mod_security (id:240335) triggered by 188.253.221.233 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 11:41:31.986427 2026] [security2:error] [pid 8787:tid 8787] [client 188.253.221.233:14074] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 188.253.221.233 (+1 hits since last alert)|ssion.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ssion.com"] [uri "/xmlrpc.php"] [unique_id "ahRtq6KOdz_guiHvXZgNAwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-25 13:08:23
UTC ·
(5 months ago)
Attac
Brute-Force
