🇺🇸
TPI-Abuse
2026-11-06 09:26:57
UTC ·
(21 hours ago)
(mod_security) mod_security (id:210350) triggered by 31.134.5.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 04:26:49.836363 2026] [security2:error] [pid 3716:tid 3716] [client 31.134.5.253:29193] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.5.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 04:26:49.836363 2026] [security2:error] [pid 3716:tid 3716] [client 31.134.5.253:29193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "au2dWZZVIgwz8lE7u7LbXAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-04 13:36:32
UTC ·
(2 days ago)
Not following 301 redirects — wasted requests | method: GET | path: /advance-payments-this-is-what-you-earn-by-reducing-your-credit-term/ | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Sa ...
show more
Not following 301 redirects — wasted requests | method: GET | path: /advance-payments-this-is-what-you-earn-by-reducing-your-credit-term/ | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-25 02:28:22
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 31.134.5.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 22:28:17.799662 2026] [security2:error] [pid 26606:tid 26606] [client 31.134.5.253:50761] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.5.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 22:28:17.799662 2026] [security2:error] [pid 26606:tid 26606] [client 31.134.5.253:50761] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||landjudging.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "landjudging.com"] [uri "/natl/pasthonorees.htm"] [unique_id "at1pQXrDpAXS9DKamyFIuAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 01:25:46
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 31.134.5.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 21:25:38.345266 2026] [security2:error] [pid 17342:tid 17342] [client 31.134.5.253:28411] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.5.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 21:25:38.345266 2026] [security2:error] [pid 17342:tid 17342] [client 31.134.5.253:28411] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.mwrn.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.mwrn.com"] [uri "/TEM/resources.cshtml"] [unique_id "atgUkraoVr2-IizA5p_puwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇭
SOC [GOLINE SA]
2026-09-08 06:24:52
UTC ·
(1 month ago)
[RoutePulse | 2026-09-08T06:24:52Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 31.134.5.253 · AS43444 Fast Servers (Pty) Ltd · Seychelles
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed ...
show more
[RoutePulse | 2026-09-08T06:24:52Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 31.134.5.253 · AS43444 Fast Servers (Pty) Ltd · Seychelles
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed attack (4 attempts/15min) — shun on the VPN gateway
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
Brute-Force
Hacking
🇺🇸
TPI-Abuse
2026-07-02 22:49:18
UTC ·
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 31.134.5.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 18:49:13.299786 2026] [security2:error] [pid 4783:tid 4783] [client 31.134.5.253:62275] ModSe ...
show more
(mod_security) mod_security (id:225170) triggered by 31.134.5.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 18:49:13.299786 2026] [security2:error] [pid 4783:tid 4783] [client 31.134.5.253:62275] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||coyotebytes.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "coyotebytes.net"] [uri "/wp-json/wp/v2/users"] [unique_id "akbq6VfauHMZ9XKDTDn2DQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
vandomatos
2026-06-22 04:49:13
UTC ·
(4 months ago)
Jun 21 21:49:06 servidor sshd[767793]: Failed password for invalid user 2083o24horautosocorr from 31.134.5.253 port 41263 ssh2
Jun 21 21:49:06 servidor sshd[767793]: error: Received disconnect from 31.134.5.253 port 41263:3: com.jcraft.jsch.JSchExcep ...
show more
Jun 21 21:49:06 servidor sshd[767793]: Failed password for invalid user 2083o24horautosocorr from 31.134.5.253 port 41263 ssh2
Jun 21 21:49:06 servidor sshd[767793]: error: Received disconnect from 31.134.5.253 port 41263:3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Jun 21 21:49:06 servidor sshd[767793]: Disconnected from invalid user 2083o24horautosocorr 31.134.5.253 port 41263 [preauth]
...
show less
Brute-Force
SSH
🇮🇩
BPS-StatisticsIndonesia
2026-06-14 15:35:36
UTC ·
(4 months ago)
WP Login Scan Activities: "2026-06-14T22:35:36.395+07:00" "/wp-login.php" "31.134.5.253" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
Web App Attack
🇫🇷
Tilellit.PRO
2026-06-08 19:58:38
UTC ·
(4 months ago)
Fail2Ban banned 31.134.5.253 for security violations in jail wp-armour. Log: 2026/06/08 19:58:38 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 31.134.5.253 | Target: wplogin" , client: 31.134.5.253, server: [REDACTED], request: "P ...
show more
Fail2Ban banned 31.134.5.253 for security violations in jail wp-armour. Log: 2026/06/08 19:58:38 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 31.134.5.253 | Target: wplogin" , client: 31.134.5.253, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://espsformacion.com/wp-login.php"
...
show less
Web Spam
🇨🇭
backslash
2026-02-15 07:10:18
UTC ·
(8 months ago)
Bad Web Bot
2025-12-22 08:50:23
UTC ·
(10 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.12.22 is noted in report timestamp
Hacking
Brute-Force
2025-12-18 11:15:08
UTC ·
(10 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.12.18 is noted in report timestamp
Hacking
Brute-Force
🇺🇸
inspectorgdgt
2025-12-18 01:06:06
UTC ·
(10 months ago)
Failed login invalid user bruteforce attempt
Brute-Force
SSH
