🇺🇸
TPI-Abuse
2026-06-05 09:47:53
(1 week ago)
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 05:47:46.512239 2026] [security2:error] [pid 1191:tid 1191] [client 95.181.233.25:14268] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||desertalfas.org|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "desertalfas.org"] [uri "/license.txt"] [unique_id "aiKbQlBBAvUngx0PEKBH8AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-05 09:32:10
(1 week ago)
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 05:32:03.960469 2026] [security2:error] [pid 11033:tid 11033] [client 95.181.233.25:8120] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||demircan.org|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "demircan.org"] [uri "/license.txt"] [unique_id "aiKXk8NrWr9JMek4DsitWQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-05 09:11:47
(1 week ago)
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 05:11:41.151677 2026] [security2:error] [pid 27979:tid 27979] [client 95.181.233.25:45882] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||decroos.org|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "decroos.org"] [uri "/license.txt"] [unique_id "aiKSzXRRsEN97dNEK3ip2QAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-05 08:46:29
(1 week ago)
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 04:46:23.536024 2026] [security2:error] [pid 14776:tid 14776] [client 95.181.233.25:62553] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||davidmoisan.org|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "davidmoisan.org"] [uri "/license.txt"] [unique_id "aiKM393BLaqYOIFW5BxfaQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-05 08:29:59
(1 week ago)
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 04:29:51.835789 2026] [security2:error] [pid 29956:tid 29956] [client 95.181.233.25:47275] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||danieljensen.org|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "danieljensen.org"] [uri "/license.txt"] [unique_id "aiKI_4dX7EqeZJKSDK16agAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-05 08:14:54
(1 week ago)
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 04:14:49.594611 2026] [security2:error] [pid 15167:tid 15167] [client 95.181.233.25:65506] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||cwvr.org|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "cwvr.org"] [uri "/license.txt"] [unique_id "aiKFec0FGOXGdLY0vhWexAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
technojoe99
2026-06-05 08:10:05
(1 week ago)
Exploit scan from 95.181.233.25. GET /license.txt HTTP/1.1.
Web App Attack
🇺🇸
TPI-Abuse
2026-06-05 07:53:26
(1 week ago)
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210801) triggered by 95.181.233.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 03:53:19.273778 2026] [security2:error] [pid 15947:tid 15947] [client 95.181.233.25:42011] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||crep-psych.org|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "crep-psych.org"] [uri "/license.txt"] [unique_id "aiKAb-5LL3sjq8T8HbhCNQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-05-23 10:29:29
(3 weeks ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
int8
2026-05-12 12:56:26
(1 month ago)
2026-05-12T12:56:26.276868723Z Minecraft server scanner: status request
Port Scan
🇳🇱
FREAKISH
2026-05-12 12:55:20
(1 month ago)
2026-05-12 14:55:20: Minecraft server scan detected from 95.181.233.25 on port 25565 of 127.0.0.1
Port Scan
🇩🇪
zUnlegit
2026-05-12 12:54:49
(1 month ago)
2026-05-12 12:54:49: Minecraft server scan detected from 95.181.233.25 on port 25565 of mailserver
Port Scan
🇬🇧
consul.to
2026-04-28 06:39:14
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇮
nNordic
2026-04-21 11:22:05
(1 month ago)
Connection attempt blocked from 95.181.233.25/32
Hacking
🇬🇧
consul.to
2026-03-19 18:18:51
(2 months ago)
Web attack/malicious scanning detected
Web App Attack