🇺🇸
TPI-Abuse
2026-11-06 09:00:50
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 91.245.236.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 04:00:44.613803 2026] [security2:error] [pid 8926:tid 8926] [client 91.245.236.174:25371] M ...
show more
(mod_security) mod_security (id:210350) triggered by 91.245.236.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 04:00:44.613803 2026] [security2:error] [pid 8926:tid 8926] [client 91.245.236.174:25371] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||frightlibrary.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "frightlibrary.org"] [uri "/lib/tgoldt.htm"] [unique_id "au2XPI51mw8inlfTSdTgtgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-03 00:29:16
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇳🇱
vintia.cloud
2026-10-31 14:06:35
UTC ·
(1 week ago)
2026-10-31 14:06 UTC HTTPS/443 - exploit and credential scanning. 2 GET requests to 2 distinct paths that do not exist on this application, across 1 hostnames, first seen 2026-10-31 13:54. Sample paths: /wp-admin, /wp-login.php. User-agent: "Mozilla/ ...
show more
2026-10-31 14:06 UTC HTTPS/443 - exploit and credential scanning. 2 GET requests to 2 distinct paths that do not exist on this application, across 1 hostnames, first seen 2026-10-31 13:54. Sample paths: /wp-admin, /wp-login.php. User-agent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)". Block cycle 2 for this address.
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-29 15:56:10
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 91.245.236.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 11:56:02.044403 2026] [security2:error] [pid 31492:tid 31492] [client 91.245.236.174:41971] ...
show more
(mod_security) mod_security (id:210350) triggered by 91.245.236.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 11:56:02.044403 2026] [security2:error] [pid 31492:tid 31492] [client 91.245.236.174:41971] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||modmove.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "modmove.com"] [uri "/category/music/page/4/"] [unique_id "auNsklJp_r2TDRUT8PDPIwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 01:40:20
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 91.245.236.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 21:40:14.073468 2026] [security2:error] [pid 16040:tid 16040] [client 91.245.236.174:53163] ...
show more
(mod_security) mod_security (id:210350) triggered by 91.245.236.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 21:40:14.073468 2026] [security2:error] [pid 16040:tid 16040] [client 91.245.236.174:53163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cbcfargo.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cbcfargo.com"] [uri "/site/Resources/devotionals/2026-03-08.php"] [unique_id "atwMfrEjVJ8nrZL-hNHEhwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
bps-statistics
2026-09-26 18:00:47
UTC ·
(1 month ago)
WP Login Scan Activities: "2026-09-27T01:00:47.129+07:00" "/wp-login.php" "91.245.236.174" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
Web App Attack
🇸🇪
OnTheEdge
2026-09-14 14:23:43
UTC ·
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇸🇪
OnTheEdge
2026-09-14 14:23:43
UTC ·
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-12 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇭
backslash
2026-08-04 00:06:02
UTC ·
(3 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
mnsf
2026-03-19 16:11:52
UTC ·
(7 months ago)
Scanning/Probing (14)
Brute-Force
Web App Attack
🇳🇿
Tripwire
2026-03-02 15:23:45
UTC ·
(8 months ago)
Wordpress login attempts
Brute-Force
Web App Attack
🇳🇱
Mangelot Hosting
2026-02-25 15:47:19
UTC ·
(8 months ago)
(bad_user_agent) srv101 Bad User-Agent 91.245.236.174 (GB/United Kingdom/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇬🇧
adnscom.net
2026-02-25 04:06:08
UTC ·
(8 months ago)
IPS trigger: Brute force WebApp/CMS scanning/attack
Brute-Force
Web App Attack
