|
Anonymous
|
|
Repeated failed SSH authentication attempts over TCP triggered a Fail2Ban ban.
|
Brute-Force
SSH
|
|
🇺🇸
bluecloudwork
|
|
Fail2Ban - Brute-force SSH server
...
|
Brute-Force
SSH
|
|
🇫🇷
AmStaff
|
|
Honeypot: 3 SSH login attempts; 1 shell command executed after login. Targeted ports: SSH.
|
Hacking
Brute-Force
SSH
|
|
🇧🇬
OHOST.BG
|
|
Oct 1 02:30:47 gamehost sshd[2618079]: Failed password for root from 104.128.72.143 port 25317 ssh2
Oct 1 02:30:51 gamehost sshd[2618084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.128.72.143 user= ...
show more
Oct 1 02:30:47 gamehost sshd[2618079]: Failed password for root from 104.128.72.143 port 25317 ssh2
Oct 1 02:30:51 gamehost sshd[2618084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.128.72.143 user=root
Oct 1 02:30:53 gamehost sshd[2618084]: Failed password for root from 104.128.72.143 port 25827 ssh2
Oct 1 02:31:03 gamehost sshd[2618092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.128.72.143 user=root
Oct 1 02:31:05 gamehost sshd[2618092]: Failed password for root from 104.128.72.143 port 2469 ssh2
...
show less
|
Brute-Force
SSH
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210350) triggered by 104.128.72.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 05:17:14.435982 2026] [security2:error] [pid 8024:tid 8024] [client 104.128.72.143:14877] M ...
show more
(mod_security) mod_security (id:210350) triggered by 104.128.72.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 05:17:14.435982 2026] [security2:error] [pid 8024:tid 8024] [client 104.128.72.143:14877] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||b9k9.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "b9k9.com"] [uri "/php-cgi/php.exe"] [unique_id "aiaImsY0497zch6qJ1ltDwAAAAQ"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210350) triggered by 104.128.72.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 05:00:49.231007 2026] [security2:error] [pid 14434:tid 14434] [client 104.128.72.143:13513] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.128.72.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 05:00:49.231007 2026] [security2:error] [pid 14434:tid 14434] [client 104.128.72.143:13513] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||antoniocobo.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "antoniocobo.com"] [uri "/index.php"] [unique_id "aiaEwR1Po7HNRqb0IBWJ_gAAAA8"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210350) triggered by 104.128.72.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 04:40:02.685695 2026] [security2:error] [pid 7122:tid 7122] [client 104.128.72.143:28589] M ...
show more
(mod_security) mod_security (id:210350) triggered by 104.128.72.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 04:40:02.685695 2026] [security2:error] [pid 7122:tid 7122] [client 104.128.72.143:28589] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aes-nihil.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aes-nihil.com"] [uri "/index.php"] [unique_id "aiZ_4mq87uxiHimOt7UyaAAAAAQ"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210350) triggered by 104.128.72.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 04:05:03.295340 2026] [security2:error] [pid 10408:tid 10408] [client 104.128.72.143:20789] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.128.72.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 04:05:03.295340 2026] [security2:error] [pid 10408:tid 10408] [client 104.128.72.143:20789] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||21north.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "21north.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aiZ3r1BfYIY-IIA_TayZFwAAAAU"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇨🇳
鹏鹏
|
|
monitor: on VM-0-7-ubuntu | port: 4576 | ttl: 251 script: github.com/sefinek/UFW-AbuseIPDB-Reporter
|
Port Scan
|
