🇺🇸
TPI-Abuse
2026-11-08 16:51:47
UTC ·
(40 minutes ago)
(mod_security) mod_security (id:210350) triggered by 193.151.189.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 11:51:42.740106 2026] [security2:error] [pid 4804:tid 4804] [client 193.151.189.132:46569] ...
show more
(mod_security) mod_security (id:210350) triggered by 193.151.189.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 11:51:42.740106 2026] [security2:error] [pid 4804:tid 4804] [client 193.151.189.132:46569] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||socialstudiesforkids.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "socialstudiesforkids.com"] [uri "/articles/ushistory/rootbeer_invention.htm"] [unique_id "avCongJ-DHGPxyFpy-FUPwAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 04:17:50
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 193.151.189.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 00:17:45.999580 2026] [security2:error] [pid 31413:tid 31413] [client 193.151.189.132:1933 ...
show more
(mod_security) mod_security (id:210350) triggered by 193.151.189.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 00:17:45.999580 2026] [security2:error] [pid 31413:tid 31413] [client 193.151.189.132:19331] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cyclingboardgames.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cyclingboardgames.net"] [uri "/cyclolists.htm"] [unique_id "auQaaVFWZuM_wzUEYgy8SwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 07:06:09
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 193.151.189.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 03:06:01.596673 2026] [security2:error] [pid 27528:tid 27528] [client 193.151.189.132:6069 ...
show more
(mod_security) mod_security (id:210350) triggered by 193.151.189.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 03:06:01.596673 2026] [security2:error] [pid 27528:tid 27528] [client 193.151.189.132:60697] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.edgeimprov.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.edgeimprov.com"] [uri "/edge/Improv_Blog/Entries/2011/1/6_Improvention_2010_-_Looking_back.html"] [unique_id "atxY2QFlJkBOdgNL2btHswAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 16:07:45
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 193.151.189.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 12:07:40.783097 2026] [security2:error] [pid 17568:tid 17568] [client 193.151.189.132:3248 ...
show more
(mod_security) mod_security (id:210350) triggered by 193.151.189.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 12:07:40.783097 2026] [security2:error] [pid 17568:tid 17568] [client 193.151.189.132:32481] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.fortwaynepartybuses.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fortwaynepartybuses.com"] [uri "/faq.html"] [unique_id "atJLzMVjKM-ib3RmddlqngAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 14:36:57
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 193.151.189.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:36:52.961147 2026] [security2:error] [pid 32228:tid 32228] [client 193.151.189.132:4689 ...
show more
(mod_security) mod_security (id:210350) triggered by 193.151.189.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:36:52.961147 2026] [security2:error] [pid 32228:tid 32228] [client 193.151.189.132:46893] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||picayunity.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "picayunity.com"] [uri "/2018/february.html"] [unique_id "atDlBKp8Zt8Tu6wSJWY0IQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
taivas.nl
2026-10-07 14:02:12
UTC ·
(1 month ago)
Bad_requests
Bad Web Bot
🇬🇧
consul.to
2026-10-05 15:13:14
UTC ·
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
LRob
2026-09-24 15:44:31
UTC ·
(1 month ago)
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack t ...
show more
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack tools, blocked on sight. Please check the machine behind it. | method: POST | path: /xmlrpc.php | 2026-09-24 15:44 UTC
show less
Web App Attack
Hacking
🇳🇱
Alt255
2026-09-23 15:49:10
UTC ·
(1 month ago)
[ti-01sc] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 193.151.189.132 - - [23/Sep/2026:17:48:22 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple ...
show more
[ti-01sc] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 193.151.189.132 - - [23/Sep/2026:17:48:22 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
193.151.189.132 - - [23/Sep/2026:17:48:42 +0200] "POST /wp-login.php HTTP/2.0" 200 4487 "https://www.nieuwsvoordietisten.nl/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
193.151.189.132 - - [23/Sep/2026:17:48:44 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
193.151.189.132 - - [23/Sep/2026:17:
...
show less
Brute-Force
Web App Attack
🇫🇮
bittiguru.fi
2026-09-22 05:27:25
UTC ·
(1 month ago)
193.151.189.132 - [22/Sep/2026:08:26:38 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" "4.66"
193.151.189.132 - [22/Sep/2026:08:27:24 +0300] "POST /xmlrpc.php HTTP/2 ...
show more
193.151.189.132 - [22/Sep/2026:08:26:38 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" "4.66"
193.151.189.132 - [22/Sep/2026:08:27:24 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" "4.66"
...
show less
Hacking
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇳🇱
Site.eu
2026-05-17 19:16:55
UTC ·
(5 months ago)
Excessive 404/403 errors
Brute-Force
🇺🇸
rsa
2026-03-04 00:27:00
UTC ·
(8 months ago)
excessive crawling ddos
DDoS Attack
Web App Attack
🇫🇷
masterguru
2026-02-10 14:57:15
UTC ·
(8 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 193.151.189.132 (NL/The Netherlands/-): 1 in the last 3600 secs (0-196)
Hacking
🇨🇿
lp
2025-03-20 16:24:38
UTC ·
(1 year ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 193.151.189.132
2025-03-20T16:14:09+01:00 vpn Access-Reject 'Administrator' station: 193.151.189.132 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 193.151.189.132
2025-03-20T16:14:09+01:00 vpn Access-Reject 'Administrator' station: 193.151.189.132 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
