🇦🇺
MAGIC
2026-01-14 00:02:55
(4 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇩🇪
Packets-Decreaser.NET
2025-12-29 14:01:52
(5 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇳🇱
i-turnradio.nl
2025-12-18 01:24:25
(5 months ago)
2025-12-18 @ 02:24:25 (CET) ~ Blocked based on risk assessment and prior abuse reports
Web App Attack
2025-12-07 21:07:12
(6 months ago)
botnet
DDoS Attack
2025-12-03 17:31:17
(6 months ago)
botnet
DDoS Attack
🇺🇸
TPI-Abuse
2025-11-24 08:50:14
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.25.196 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.25.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 03:50:09.598080 2025] [security2:error] [pid 22629:tid 22629] [client 104.167.25.196:24971] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.encuentraunbuenabogado.com"] [uri "/.git/HEAD"] [unique_id "aSQcQZictRPGzv1F09u-kwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 07:55:47
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.25.196 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.25.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:55:43.124570 2025] [security2:error] [pid 1863:tid 1863] [client 104.167.25.196:59073] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.kim-porter.com"] [uri "/.svn/wc.db"] [unique_id "aSQPf2OoIOxaI0HTcEBTaQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 07:13:28
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.25.196 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.25.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:13:24.920222 2025] [security2:error] [pid 12103:tid 12141] [client 104.167.25.196:24609] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.power51.com"] [uri "/.env"] [unique_id "aSQFlOd3pxroRSWDTtpg9QAAAMg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 04:36:39
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.25.196 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.25.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:36:25.087964 2025] [security2:error] [pid 2893:tid 2902] [client 104.167.25.196:28613] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.princesscastlebunkbed.com"] [uri "/.git/HEAD"] [unique_id "aSPgySZWVzJkk5khHgNiUgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
ki3
2025-11-15 16:02:39
(6 months ago)
Fail2Ban: Web App Attacks and Forum Spam 104.167.25.196 1763222558.0(JST)
Web Spam
Bad Web Bot
Web App Attack
2025-11-14 02:44:14
(6 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇩🇪
F242
2025-10-26 06:53:03
(7 months ago)
Wordpress Login or XMLRPC abuse
Web App Attack
🇨🇦
wil.com
2025-10-15 03:50:25
(7 months ago)
GlobalProtect login attempts with user dfragoso.
VPN IP
Brute-Force
2025-10-14 10:22:36
(7 months ago)
Dictionary attack on Palo Alto GlobalProtect VPN portal (port 443) detected via repeated login failu ...
show more
Dictionary attack on Palo Alto GlobalProtect VPN portal (port 443) detected via repeated login failures with varying usernames.
show less
Brute-Force
2025-10-13 17:07:31
(7 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.10.13 is noted in report tim ...
show more
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.10.13 is noted in report timestamp
show less
Hacking
Brute-Force