🇺🇸
TPI-Abuse
2026-11-14 03:31:52
UTC ·
(11 hours ago)
(mod_security) mod_security (id:210350) triggered by 31.134.5.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 22:31:47.635951 2026] [security2:error] [pid 23712:tid 23712] [client 31.134.5.32:16083] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.5.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 22:31:47.635951 2026] [security2:error] [pid 23712:tid 23712] [client 31.134.5.32:16083] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||tulsatvmemories.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "tulsatvmemories.com"] [uri "/chew2010/somewhere"] [unique_id "avfWI0edPKh1KFCMKUGSIQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 05:06:19
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 31.134.5.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 00:06:13.411169 2026] [security2:error] [pid 13009:tid 13031] [client 31.134.5.32:44673] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.5.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 00:06:13.411169 2026] [security2:error] [pid 13009:tid 13031] [client 31.134.5.32:44673] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cargomarexpress.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cargomarexpress.com"] [uri "/product/kearz3396774"] [unique_id "avFUxWFjpQlJd_1gjF8bFgAAAUs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 20:58:28
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 31.134.5.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 15:58:22.365988 2026] [security2:error] [pid 9137:tid 9137] [client 31.134.5.32:20825] ModSecu ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.5.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 15:58:22.365988 2026] [security2:error] [pid 9137:tid 9137] [client 31.134.5.32:20825] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||celiaconaway.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "celiaconaway.com"] [uri "/+/The_History_of_Energy_Healing.html"] [unique_id "au-Q7oVFmN9wJUHlfnJWXAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 20:48:24
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 31.134.5.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 16:48:17.062700 2026] [security2:error] [pid 2253:tid 2253] [client 31.134.5.32:18519] ModSecu ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.5.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 16:48:17.062700 2026] [security2:error] [pid 2253:tid 2253] [client 31.134.5.32:18519] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||vitality-web.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "vitality-web.com"] [uri "/nutrition/gymnema.htm"] [unique_id "auJfkWjdFmF5wnVHCG1aCgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 03:16:03
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 31.134.5.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 23:15:56.291182 2026] [security2:error] [pid 11629:tid 11629] [client 31.134.5.32:32345] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 31.134.5.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 23:15:56.291182 2026] [security2:error] [pid 11629:tid 11629] [client 31.134.5.32:32345] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||wmionline.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "wmionline.org"] [uri "/aboutus/pfeatures/pfeatures.html"] [unique_id "atwi7ArYjWii8ACe6tMg_QAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-10 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇸🇪
OnTheEdge
2026-09-09 03:38:26
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇿
Countryman
2026-09-09 01:42:34
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇪🇸
sshtmp
2026-05-25 08:28:49
UTC ·
(5 months ago)
[AbuseIPDB auto-report]
Attack: WordPress XML-RPC brute-force
Hits: 1 | First: 2026-05-25T10:28:49+02:00 | Last: 2026-05-25T10:28:49+02:00
Samples: POST /xmlrpc.php [200]
Brute-Force
Web App Attack
2025-12-22 08:25:00
UTC ·
(10 months ago)
IM360 WAF: Attempt to upload malware
Hacking
2025-06-02 18:25:00
UTC ·
(1 year ago)
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-06-02 time=11:38:50 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1748882330876419428 tz="-0500" logid="0101039426" type="even ...
show more
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-06-02 time=11:38:50 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1748882330876419428 tz="-0500" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=31.134.5.32 srccountry="United States" user="reception" group="N/A" dst_host="N/A" reason="sslvpn_login_unknown_user" msg="SSL user failed to logged in"
show less
VPN IP
