🇺🇸
TPI-Abuse
2026-11-11 15:23:21
UTC ·
(18 hours ago)
(mod_security) mod_security (id:210350) triggered by 45.147.234.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 10:23:15.447667 2026] [security2:error] [pid 9302:tid 9302] [client 45.147.234.104:39819] M ...
show more
(mod_security) mod_security (id:210350) triggered by 45.147.234.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 10:23:15.447667 2026] [security2:error] [pid 9302:tid 9302] [client 45.147.234.104:39819] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||powerlinemultimedia.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "powerlinemultimedia.net"] [uri "/music.htm"] [unique_id "avSIY37cTUFRMV7rBX7OYQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 12:08:43
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 45.147.234.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 08:08:36.224413 2026] [security2:error] [pid 31540:tid 31540] [client 45.147.234.104:40073] ...
show more
(mod_security) mod_security (id:210350) triggered by 45.147.234.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 08:08:36.224413 2026] [security2:error] [pid 31540:tid 31540] [client 45.147.234.104:40073] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ken-parker.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ken-parker.com"] [uri "/newnaninfo.html"] [unique_id "auHlxE7ntKXDwypOkH6HBQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 17:44:00
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 45.147.234.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 13:43:53.235923 2026] [security2:error] [pid 15204:tid 15204] [client 45.147.234.104:47955] ...
show more
(mod_security) mod_security (id:210350) triggered by 45.147.234.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 13:43:53.235923 2026] [security2:error] [pid 15204:tid 15204] [client 45.147.234.104:47955] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||kennythompson.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "kennythompson.com"] [uri "/gallery/holidays/birthdays/meam91/meam.htm"] [unique_id "at-RWQl8G1XiwSo7a4rCEQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-16 00:10:02
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-14 06:23:24
UTC ·
(1 month ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 45.147.234.104
2026-09-14T07:05:43+02:00 vpn Access-Reject 'dent' station: 45.147.234.104 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 45.147.234.104
2026-09-14T07:05:43+02:00 vpn Access-Reject 'dent' station: 45.147.234.104 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2025-10-14 23:36:57
UTC ·
(1 year ago)
(mod_security) mod_security (id:210350) triggered by 45.147.234.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 14 19:36:50.997576 2025] [security2:error] [pid 5223:tid 5223] [client 45.147.234.104:11323] M ...
show more
(mod_security) mod_security (id:210350) triggered by 45.147.234.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 14 19:36:50.997576 2025] [security2:error] [pid 5223:tid 5223] [client 45.147.234.104:11323] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||prodigypartners.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "prodigypartners.com"] [uri "/"] [unique_id "aO7ekthOSvWw_2tQMLad-AAAABA"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-06 14:30:00
UTC ·
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 45.147.234.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 06 10:29:55.461459 2025] [security2:error] [pid 830:tid 830] [client 45.147.234.104:14261] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 45.147.234.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 06 10:29:55.461459 2025] [security2:error] [pid 830:tid 830] [client 45.147.234.104:14261] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.oualierealty.com"] [uri "/development/.env"] [unique_id "aOPSY2vzPr0iUINryXrylwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Packets-Decreaser.NET
2025-09-23 06:02:53
UTC ·
(1 year ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
2025-06-26 11:12:00
UTC ·
(1 year ago)
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-06-26 time=01:08:57 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1750918137414982722 tz="-0500" logid="0101039426" type="even ...
show more
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-06-26 time=01:08:57 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1750918137414982722 tz="-0500" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=45.147.234.104 srccountry="United States" user="BESadmin" group="N/A" dst_host="N/A" reason="sslvpn_login_unknown_user" msg="SSL user failed to logged in"
show less
VPN IP
2025-06-23 11:15:00
UTC ·
(1 year ago)
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-06-21 time=19:33:27 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1750552407073384839 tz="-0500" logid="0101039426" type="even ...
show more
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2025-06-21 time=19:33:27 devname=FortiGate-200F devid=FG200FT922906136 eventtime=1750552407073384839 tz="-0500" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=45.147.234.104 srccountry="United States" user="dwilliams" group="N/A" dst_host="N/A" reason="sslvpn_login_unknown_user" msg="SSL user failed to logged in"
show less
VPN IP
