🇺🇸
TPI-Abuse
2026-11-10 09:53:19
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210350) triggered by 45.147.232.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:53:11.966229 2026] [security2:error] [pid 16147:tid 16147] [client 45.147.232.57:54495] M ...
show more
(mod_security) mod_security (id:210350) triggered by 45.147.232.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:53:11.966229 2026] [security2:error] [pid 16147:tid 16147] [client 45.147.232.57:54495] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.grupo-visalud.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.grupo-visalud.com"] [uri "/2024/08/solved-what-are-an-abundant-glucose-mommy-uk-using-the-internet-free-of-charge/"] [unique_id "avLph0dOAwL-MSm6m6J8cgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-31 21:57:46
UTC ·
(1 week ago)
Web exploit attempt | method: GET | path: / | query: author=1, author=2 | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 20:46:12
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 45.147.232.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:46:08.904604 2026] [security2:error] [pid 29132:tid 29132] [client 45.147.232.57:58049] M ...
show more
(mod_security) mod_security (id:210350) triggered by 45.147.232.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:46:08.904604 2026] [security2:error] [pid 29132:tid 29132] [client 45.147.232.57:58049] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.byles.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.byles.net"] [uri "/pen-review/2021-8-30-pen-and-notepad-review-midori-md-fountain-pen-md-a5-notebook-and-md-paper-notebook-cover/"] [unique_id "atkkkA7ywV2pizwra5XJ0QAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
DRI
2026-09-30 06:42:45
UTC ·
(1 month ago)
Web attack/Malicious activity detected
Web App Attack
🇺🇸
TPI-Abuse
2026-09-25 06:49:53
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 45.147.232.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 02:49:47.327320 2026] [security2:error] [pid 19224:tid 19224] [client 45.147.232.57:49817] M ...
show more
(mod_security) mod_security (id:225170) triggered by 45.147.232.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 02:49:47.327320 2026] [security2:error] [pid 19224:tid 19224] [client 45.147.232.57:49817] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||primacomm.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "primacomm.com"] [uri "/wp-json/wp/v2/users"] [unique_id "arYZi6Ea4p-LAQah0xDkZAAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-09-20 22:31:01
UTC ·
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇨🇿
Countryman
2026-09-15 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-12 07:51:33
UTC ·
(1 month ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 45.147.232.57
2026-09-12T08:29:14+02:00 vpn Access-Reject 'F100049' station: 45.147.232.57 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacte ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 45.147.232.57
2026-09-12T08:29:14+02:00 vpn Access-Reject 'F100049' station: 45.147.232.57 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇭
SOC [GOLINE SA]
2026-09-08 21:59:16
UTC ·
(2 months ago)
[RoutePulse | 2026-09-08T21:59:16Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 45.147.232.57
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed attack (3 attempts/15min) — shun on the VPN g ...
show more
[RoutePulse | 2026-09-08T21:59:16Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 45.147.232.57
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed attack (3 attempts/15min) — shun on the VPN gateway
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
Brute-Force
Hacking
🇩🇪
FeG Deutschland
2026-08-31 12:07:08
UTC ·
(2 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 127
Exploited Host
Web App Attack
🇺🇦
URAN Publishing Service
2026-08-25 20:34:19
UTC ·
(2 months ago)
[25/Aug/2026:23:34:18 +0300] -- 45.147.232.57 Ban reason: Scanner [CMS_GENERIC] | Request: GET /administrator/ HTTP/1.1
Bad Web Bot
Web App Attack
🇫🇮
JimArchon72
2026-07-20 01:45:02
UTC ·
(3 months ago)
2026/07/20 01:40:50 "GET /wp-login.php?action=register HTTP/1.1"
Web App Attack
🇺🇸
TPI-Abuse
2026-05-19 01:06:10
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 45.147.232.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 21:06:06.655475 2026] [security2:error] [pid 18514:tid 18514] [client 45.147.232.57:27137] M ...
show more
(mod_security) mod_security (id:225170) triggered by 45.147.232.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 21:06:06.655475 2026] [security2:error] [pid 18514:tid 18514] [client 45.147.232.57:27137] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||drdot.xyz|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "drdot.xyz"] [uri "/wp-json/wp/v2/users"] [unique_id "agu3fvVFbJ7wA4TfQCPWmgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-01-21 20:47:52
UTC ·
(9 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2026.01.21 is noted in report timestamp
Hacking
Brute-Force
