🇺🇸
TPI-Abuse
2026-10-28 11:18:00
(14 hours ago)
(mod_security) mod_security (id:210350) triggered by 45.159.21.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 07:17:53.018952 2026] [security2:error] [pid 20540:tid 20540] [client 45.159.21.191:24561] M ...
show more
(mod_security) mod_security (id:210350) triggered by 45.159.21.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 07:17:53.018952 2026] [security2:error] [pid 20540:tid 20540] [client 45.159.21.191:24561] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||borzoi-pedigree.batw.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "borzoi-pedigree.batw.net"] [uri "/pedstore/t/TigowofRomanoff.html"] [unique_id "auHZ4UL34yjJ31n1kQy01gAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 09:50:28
(16 hours ago)
(mod_security) mod_security (id:210350) triggered by 45.159.21.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 05:50:24.107116 2026] [security2:error] [pid 10803:tid 10941] [client 45.159.21.191:49641] M ...
show more
(mod_security) mod_security (id:210350) triggered by 45.159.21.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 05:50:24.107116 2026] [security2:error] [pid 10803:tid 10941] [client 45.159.21.191:49641] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.gotlib.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.gotlib.net"] [uri "/poetry/"] [unique_id "auHFYJCfIz2VEz-blxECWwAAAFQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
donarev419
2026-10-26 00:36:05
(3 days ago)
Port scan detected on port 5901 (connection without data transfer)
Port Scan
🇫🇷
thecocasio
2026-10-24 15:22:06
(4 days ago)
PortSentry honeypot: unsolicited TCP connection to closed decoy port 5900 (VNC) on a host running no such service. Automated port-scan detection at 2026-10-24T15:22:06Z.
Port Scan
🇺🇸
TPI-Abuse
2026-10-24 02:00:21
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 45.159.21.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 22:00:15.645237 2026] [security2:error] [pid 23519:tid 23519] [client 45.159.21.191:29633] M ...
show more
(mod_security) mod_security (id:210350) triggered by 45.159.21.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 22:00:15.645237 2026] [security2:error] [pid 23519:tid 23519] [client 45.159.21.191:29633] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.turtlehill.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.turtlehill.org"] [uri "/cleanup/khen/blz0.html"] [unique_id "atwRL0Lm06Axo4v3wAM3nwAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
LRob
2026-10-19 12:09:55
(1 week ago)
WordPress attack-tool calls | method: GET | path: /xmlrpc.php | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
Web App Attack
Hacking
2026-10-12 19:05:36
(2 weeks ago)
Aggressive web scan
Web App Attack
🇨🇿
lp
2026-09-11 10:51:54
(1 month ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 45.159.21.191
2026-09-11T12:42:55+02:00 vpn Access-Reject 'dadi' station: 45.159.21.191 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
Brute-Force
Web App Attack
🇨🇿
lp
2026-09-09 16:51:33
(1 month ago)
Unauthorized VPN login attempts: 2 attempts were recorded from 45.159.21.191
2026-09-09T17:31:32+02:00 vpn Access-Reject 'oranuchjuti' station: 45.159.21.191 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<red ...
show more
Unauthorized VPN login attempts: 2 attempts were recorded from 45.159.21.191
2026-09-09T17:31:32+02:00 vpn Access-Reject 'oranuchjuti' station: 45.159.21.191 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-09T17:32:52+02:00 vpn Access-Reject 'natthawat.no' station: 45.159.21.191 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇸🇪
OnTheEdge
2026-09-08 14:08:59
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇩🇪
Ilop
2026-09-06 02:30:05
(1 month ago)
[hp-100] 13 unsolicited packets to honeypot ports 8000 (OCI DShield sensor)
Port Scan
🇳🇱
DonAtari
2026-09-05 15:01:54
(1 month ago)
DShield firewall scan - TCP to port 8000
Brute-Force
SSH
🇫🇮
JimArchon72
2026-07-02 01:00:01
(3 months ago)
2026/07/02 00:58:51 "GET /wp-login.php HTTP/1.1"
Web App Attack
🇪🇸
librebit
2026-06-25 05:02:10
(4 months ago)
Brute force
Brute-Force
🇪🇸
librebit
2026-06-21 01:23:25
(4 months ago)
Brute force
Brute-Force
