🇩🇪
tall1oN
2026-09-24 01:12:14
(3 hours ago)
104.167.19.113 - - [24/Sep/2026:03:11:59 +0200] "GET /wp-login.php HTTP/2.0" 200 13865 "-" "CMS-Secu ...
show more
104.167.19.113 - - [24/Sep/2026:03:11:59 +0200] "GET /wp-login.php HTTP/2.0" 200 13865 "-" "CMS-Security-Auditor/1.0 (+authorized self-check; contact: local-admin)" "gadget.demons-gaming.cc"
104.167.19.113 - - [24/Sep/2026:03:12:13 +0200] "GET /xmlrpc.php HTTP/2.0" 200 13865 "-" "CMS-Security-Auditor/1.0 (+authorized self-check; contact: local-admin)" "gadget.demons-gaming.cc"
...
show less
Web App Attack
Port Scan
Hacking
🇺🇸
drewf.ink
2026-09-24 00:18:14
(3 hours ago)
[00:18] Attempted HTTPS GlobalProtect login with credentials erogers:Se**********6!
Web App Attack
🇲🇹
Malta
2026-09-15 20:56:03
(1 week ago)
104.167.19.113 - - [15/Sep/2026:22:56:02 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows ...
show more
104.167.19.113 - - [15/Sep/2026:22:56:02 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
show less
Hacking
Web App Attack
VPN IP
🇺🇸
fbarela
2026-01-25 04:01:44
(7 months ago)
FortiGate SSL VPN login failures.
Hacking
Brute-Force
🇩🇪
Packets-Decreaser.NET
2025-12-29 14:01:38
(8 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
TPI-Abuse
2025-12-27 21:56:20
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.19.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.19.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 16:56:12.910791 2025] [security2:error] [pid 31641:tid 31641] [client 104.167.19.113:12525] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mariedjones.com"] [uri "/.svn/wc.db"] [unique_id "aVBV_JLdk5XWAycmz7Se7AAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-27 21:40:07
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.19.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.19.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 16:40:01.785429 2025] [security2:error] [pid 5991:tid 5993] [client 104.167.19.113:59097] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "maestrosoler.com"] [uri "/.git/HEAD"] [unique_id "aVBSMWcW5gXEqpyJT5F2SgAAAEA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
2000cn.com.au
2025-12-27 19:02:16
(8 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-12-27 17:43:04
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.19.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.19.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 12:42:58.850436 2025] [security2:error] [pid 342:tid 342] [client 104.167.19.113:58523] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tttns.com"] [uri "/.svn/wc.db"] [unique_id "aVAaoo4Cj4UCRuZZTcXFJwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-27 17:14:56
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.19.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.19.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 12:14:50.169078 2025] [security2:error] [pid 5883:tid 5883] [client 104.167.19.113:42211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "atlanticcitypartybuses.com"] [uri "/.env"] [unique_id "aVAUCkVLbh-7G4cHJ6MD3gAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2025-12-23 16:55:32
(9 months ago)
Detected attack and reported by a human
DDoS Attack
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
🇦🇺
MAGIC
2025-12-20 02:01:58
(9 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇱🇻
garmtech.com
2025-12-04 17:12:46
(9 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 19-12.104.167.19.113.web-spamm ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 19-12.104.167.19.113.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 11:17:01
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.19.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.19.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 06:16:57.847625 2025] [security2:error] [pid 11094:tid 11094] [client 104.167.19.113:50447] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.toody.com"] [uri "/.env"] [unique_id "aSbhqRIYmuMdxuJFaHVAqwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 09:50:44
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.19.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.19.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 04:50:41.792874 2025] [security2:error] [pid 20071:tid 20071] [client 104.167.19.113:22353] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.awani-associatescom.awani-partners.com"] [uri "/.git/HEAD"] [unique_id "aSbNcZ_VLnqcgs3OeplYjAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
