🇺🇸
TPI-Abuse
2026-11-15 03:55:29
UTC ·
(19 minutes ago)
(mod_security) mod_security (id:210350) triggered by 5.181.171.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 22:55:12.007801 2026] [security2:error] [pid 32670:tid 32670] [client 5.181.171.134:44377] M ...
show more
(mod_security) mod_security (id:210350) triggered by 5.181.171.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 22:55:12.007801 2026] [security2:error] [pid 32670:tid 32670] [client 5.181.171.134:44377] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jerusalem-korczak-home.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jerusalem-korczak-home.com"] [uri "/rek/RKZ/arhiv/09-05.htm"] [unique_id "avktIGG2289av7hjD7qo_QAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 20:01:26
UTC ·
(8 hours ago)
(mod_security) mod_security (id:210350) triggered by 5.181.171.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 15:01:10.130728 2026] [security2:error] [pid 24254:tid 24279] [client 5.181.171.134:28037] M ...
show more
(mod_security) mod_security (id:210350) triggered by 5.181.171.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 15:01:10.130728 2026] [security2:error] [pid 24254:tid 24279] [client 5.181.171.134:28037] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||certifiedprojectmanager.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "certifiedprojectmanager.us"] [uri "/renew.html"] [unique_id "avi-Bj2dcLZngsQ4q4RtZQAAAVY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-14 20:00:14
UTC ·
(8 hours ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-10 00:47:57
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 5.181.171.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:47:45.254302 2026] [security2:error] [pid 23699:tid 23699] [client 5.181.171.134:16115] M ...
show more
(mod_security) mod_security (id:210350) triggered by 5.181.171.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:47:45.254302 2026] [security2:error] [pid 23699:tid 23699] [client 5.181.171.134:16115] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ictsl.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ictsl.net"] [uri "/productos/plastico/probetagraduadaclasebppplasticokartell.html"] [unique_id "avJpsbsHgbp6sqy3GXSQCAAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 19:54:56
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 5.181.171.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 15:54:39.403431 2026] [security2:error] [pid 25317:tid 25317] [client 5.181.171.134:29175] M ...
show more
(mod_security) mod_security (id:210350) triggered by 5.181.171.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 15:54:39.403431 2026] [security2:error] [pid 25317:tid 25317] [client 5.181.171.134:29175] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.powerkiteforum.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.powerkiteforum.com"] [uri "/viewthread.php"] [unique_id "at-v_4JgofXNThm7WAv9kAAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
lp
2026-09-14 07:51:31
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 3 attempts were recorded from 5.181.171.134
2026-09-14T08:34:45+02:00 vpn Access-Reject 'guest' station: 5.181.171.134 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted> ...
show more
Unauthorized VPN login attempts: 3 attempts were recorded from 5.181.171.134
2026-09-14T08:34:45+02:00 vpn Access-Reject 'guest' station: 5.181.171.134 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-14T08:36:12+02:00 vpn Access-Reject 'Gittisak.C' station: 5.181.171.134 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-14T08:37:41+02:00 vpn Access-Reject 'wittaya' station: 5.181.171.134 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇸🇪
OnTheEdge
2026-09-13 18:46:47
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇸🇪
OnTheEdge
2026-09-13 18:46:47
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-11 03:23:15
UTC ·
(2 months ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 5.181.171.134
2026-09-11T04:31:55+02:00 vpn Access-Reject 'purchasing' station: 5.181.171.134 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<reda ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 5.181.171.134
2026-09-11T04:31:55+02:00 vpn Access-Reject 'purchasing' station: 5.181.171.134 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇸🇪
OnTheEdge
2026-09-08 15:49:23
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
2026-03-18 21:12:43
UTC ·
(7 months ago)
Web App Attack
Brute-Force
Web App Attack
🇺🇸
kosada.com
2026-03-12 21:24:09
UTC ·
(8 months ago)
Web password guessing
Brute-Force
🇨🇿
huginet
2026-03-07 11:14:09
UTC ·
(8 months ago)
5.181.171.134 - - [07/Mar/2026:12:14:07 +0100] "POST /xmlrpc.php HTTP/1.1" 200 181 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
5.181.171.134 - - [07/Mar/2026:12:14:08 +0100] "POST /xmlrpc.php HTTP/1.1" 503 19380 "-" "Apache-HttpClient/4.5.13 (Java/ ...
show more
5.181.171.134 - - [07/Mar/2026:12:14:07 +0100] "POST /xmlrpc.php HTTP/1.1" 200 181 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
5.181.171.134 - - [07/Mar/2026:12:14:08 +0100] "POST /xmlrpc.php HTTP/1.1" 503 19380 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
...
show less
Web Spam
Blog Spam
Hacking
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-01-21 13:13:02
UTC ·
(9 months ago)
Try to access /xmlrpc.php
Web App Attack
