🇺🇸
TPI-Abuse
2026-11-14 12:23:26
UTC ·
(18 minutes ago)
(mod_security) mod_security (id:210350) triggered by 45.136.25.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 07:23:22.297203 2026] [security2:error] [pid 3301:tid 3301] [client 45.136.25.236:14737] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 45.136.25.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 07:23:22.297203 2026] [security2:error] [pid 3301:tid 3301] [client 45.136.25.236:14737] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jerusalem-temple-today.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jerusalem-temple-today.com"] [uri "/for/viewtopic.php"] [unique_id "avhSuj3Dwbh6ykcdAiQthwAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 04:59:24
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 45.136.25.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 23:59:20.455947 2026] [security2:error] [pid 7963:tid 7963] [client 45.136.25.236:42287] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 45.136.25.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 23:59:20.455947 2026] [security2:error] [pid 7963:tid 7963] [client 45.136.25.236:42287] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||trompelart.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "trompelart.com"] [uri "/visit-trompelartsubstackcom.html"] [unique_id "avABqDn8BlI4KYcdR-r6KQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 01:42:10
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 45.136.25.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 21:42:03.526813 2026] [security2:error] [pid 28398:tid 28398] [client 45.136.25.236:58185] M ...
show more
(mod_security) mod_security (id:210350) triggered by 45.136.25.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 21:42:03.526813 2026] [security2:error] [pid 28398:tid 28398] [client 45.136.25.236:58185] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/tag/first-nations/"] [unique_id "auaY67XXg62Pa6bZ9-IwOgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-18 18:05:28
UTC ·
(3 weeks ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
SX Communications
2026-10-08 20:17:09
UTC ·
(1 month ago)
HTTP application-layer DoS / botnet traffic from 45.136.25.236: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇨🇿
Countryman
2026-09-16 00:10:02
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇫🇷
mikekarl
2026-09-13 14:09:17
UTC ·
(2 months ago)
SQL INJECTION quick_unlock'' AND 6873=6873--
SQL Injection
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-08 03:21:48
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 15 attempts were recorded from 45.136.25.236
2026-09-08T03:44:43+02:00 vpn Access-Reject 'All LDAP Users' station: 45.136.25.236 auth-type: - realm: - nas: <redacted> called: <redacted> => address-pool: - msg: 'Rejec ...
show more
Unauthorized VPN login attempts: 15 attempts were recorded from 45.136.25.236
2026-09-08T03:44:43+02:00 vpn Access-Reject 'All LDAP Users' station: 45.136.25.236 auth-type: - realm: - nas: <redacted> called: <redacted> => address-pool: - msg: 'Rejected: User-Name contains whitespace'
2026-09-08T03:46:46+02:00 vpn Access-Reject 'almacn' station: 45.136.25.236 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-08T03:48:58+02:00 vpn Access-Reject 'almacn' station: 45.136.25.236 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-08T03:51:09+02:00 vpn Access-Reject 'amira' station: 45.136.25.236 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-08T03:53:20+02:00 vpn Access-Reject 'amjad' station: 45.136.25.236 auth-type:
show less
Brute-Force
Web App Attack
🇺🇸
IndigoRidge
2026-09-03 19:33:03
UTC ·
(2 months ago)
[03/Sep/2026:15:32:55.310673 --0400] apnLZ7p3gtat9kaP3ltS1gAAARQ 45.136.25.236 33662 205.233.18.17 7081
[03/Sep/2026:15:32:59.537118 --0400] apnLa7p3gtat9kaP3ltS3gAAAQI 45.136.25.236 55910 205.233.18.17 7081
[03/Sep/2026:15:33:00.348593 --0400] apnLb ...
show more
[03/Sep/2026:15:32:55.310673 --0400] apnLZ7p3gtat9kaP3ltS1gAAARQ 45.136.25.236 33662 205.233.18.17 7081
[03/Sep/2026:15:32:59.537118 --0400] apnLa7p3gtat9kaP3ltS3gAAAQI 45.136.25.236 55910 205.233.18.17 7081
[03/Sep/2026:15:33:00.348593 --0400] apnLbLp3gtat9kaP3ltS3wAAAQg 45.136.25.236 55924 205.233.18.17 7081
[03/Sep/2026:15:33:01.195541 --0400] apnLbUItTgq1-gscN95TjwAAAE8 45.136.25.236 55944 205.233.18.17 7081
[03/Sep/2026:15:33:02.818540 --0400] apnLbrp3gtat9kaP3ltS4wAAARQ 45.136.25.236 55980 205.233.18.17 7081
...
show less
Hacking
🇬🇧
Oakley
2026-07-22 15:57:35
UTC ·
(3 months ago)
(mod_security) mod_security (id:900178) triggered by 45.136.25.236 (US/United States/-): 5 in the last 900 secs
Web App Attack
Hacking
🇩🇪
CELOS-SOC
2026-07-21 08:30:24
UTC ·
(3 months ago)
Multiple Unauthorized SSLVPN Login Attempts
Hacking
Brute-Force
🇩🇪
CELOS-SOC
2026-07-16 00:31:04
UTC ·
(3 months ago)
Multiple Unauthorized SSLVPN Login Attempts
Hacking
Brute-Force
2026-01-22 02:35:43
UTC ·
(9 months ago)
Attempted brute force login to web vpn 2 time(s); last attempt for 2026.01.22 is noted in report timestamp
Hacking
Brute-Force
2026-01-07 13:00:00
UTC ·
(10 months ago)
Malicious scan suspected (score: 3 >= 3): Directory Traversal (Path) / Multiple Slashes / reCAPTCHA challenge timed out
Hacking
Bad Web Bot
Web App Attack
