84.54.73.129

Port Scan Attack proto:TCP src:6641 dst:23

2026-11-11T14:20:12.485026+00:00 Canada1 sshd-session[2899321]: Connection closed by 84.54.73.129 port 12110 [preauth] 2026-11-11T14:20:36.337212+00:00 Canada1 sshd-session[2900769]: Connection closed by 84.54.73.129 port 16750 [preauth] ...

2026-11-11 13:23:32 UTC Unauthorized activity to TCP port 23. Telnet

(mod_security) mod_security (id:210730) triggered by 84.54.73.129 (129.73.intal.uz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 08:53:01.317907 2026] [security2:error] [pid 8898:tid 8898] [client 84.54.73.12 ... show more (mod_security) mod_security (id:210730) triggered by 84.54.73.129 (129.73.intal.uz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 08:53:01.317907 2026] [security2:error] [pid 8898:tid 8898] [client 84.54.73.129:58997] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.pswebsite.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.pswebsite.com"] [uri "/goggle.com"] [unique_id "ai_1rTOMiDlVNF-CMSEuSQAAAA0"] show less

(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security

spam

block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8

Honeypot detection: Telnet / IoT device brute-force or exploitation attempt on port 23. Severity: MEDIUM. Aaran.cloud

NOQUEUE - IP: 84.54.73.129 - May 5 04:54:04 plesk postfix/smtpd[3953774]: NOQUEUE: reject: RCPT from unknown[84.54.73.129]: 554 5.7.1 Service unavailable; Client host [84.54.73.129] blocked using dnsbl-1.uceprotect.net; IP 84.54.73.129 is UCEPROTECT ... show more NOQUEUE - IP: 84.54.73.129 - May 5 04:54:04 plesk postfix/smtpd[3953774]: NOQUEUE: reject: RCPT from unknown[84.54.73.129]: 554 5.7.1 Service unavailable; Client host [84.54.73.129] blocked using dnsbl-1.uceprotect.net; IP 84.54.73.129 is UCEPROTECT-Level 1 listed. See http://www.uceprotect.net/rblcheck.php?ipr=84.54.73.129; from=<REDACTED@REDACTED> to=<REDACTED@REDACTED> proto=ESMTP helo=<[84.54.73.129]> show less

2026-04-21T05:57:38.613788+02:00 mail postfix/postscreen[975964]: PREGREET 21 after 0.07 from [84.54.73.129]:25428: EHLO [84.54.73.129]\r\n 2026-04-21T05:57:38.823992+02:00 mail postfix/postscreen[975964]: HANGUP after 0.21 from [84.54.73.129]:25428 ... show more 2026-04-21T05:57:38.613788+02:00 mail postfix/postscreen[975964]: PREGREET 21 after 0.07 from [84.54.73.129]:25428: EHLO [84.54.73.129]\r\n 2026-04-21T05:57:38.823992+02:00 mail postfix/postscreen[975964]: HANGUP after 0.21 from [84.54.73.129]:25428 in tests after SMTP handshake 2026-04-21T05:58:37.693445+02:00 mail postfix/postscreen[975964]: PREGREET 21 after 0.07 from [84.54.73.129]:32599: EHLO [84.54.73.129]\r\n ... show less

(mod_security) mod_security (id:217210) triggered by 84.54.73.129 (129.73.intal.uz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 23:53:00.551039 2026] [security2:error] [pid 32738:tid 32738] [client 84.54.73. ... show more (mod_security) mod_security (id:217210) triggered by 84.54.73.129 (129.73.intal.uz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 23:53:00.551039 2026] [security2:error] [pid 32738:tid 32738] [client 84.54.73.129:9940] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||moon33proves.xyz|F|4"] [data "GET http://moon33proves.xyz HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "moon33proves.xyz"] [uri "/"] [unique_id "adCLHGvUi3x__SmXu8lZKAAAAAg"] show less

VM5 Bad user agents ignoring web crawling rules. Draing bandwidth

Mar 25 11:56:34 server postfix/smtpd[866553]: NOQUEUE: reject: RCPT from unknown[84.54.73.129]: 554 5.7.1 Service unavailable; Client host [84.54.73.129] blocked using zen.spamhaus.org; Listed by PBL, see https://check.spamhaus.org/query/ip/84.54.73. ... show more Mar 25 11:56:34 server postfix/smtpd[866553]: NOQUEUE: reject: RCPT from unknown[84.54.73.129]: 554 5.7.1 Service unavailable; Client host [84.54.73.129] blocked using zen.spamhaus.org; Listed by PBL, see https://check.spamhaus.org/query/ip/84.54.73.129 / Listed by XBL, see https://check.spamhaus.org/query/ip/84.54.73.129 / Listed by CSS, see https://check.spamhaus.org/query/ip/84.54.73.129; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[84.54.71.49]> ... show less

Web App Attack

Spam