🇮🇹
[email protected]
2026-04-26 22:08:39
(1 month ago)
104.207.32.48 - - [26/Apr/2026:22:12:21 +0200] "POST /xmlrpc.php HTTP/1.1" 500 5339 "-" "curl/7.88.1 ...
show more
104.207.32.48 - - [26/Apr/2026:22:12:21 +0200] "POST /xmlrpc.php HTTP/1.1" 500 5339 "-" "curl/7.88.1"
...
show less
Brute-Force
Web App Attack
🇨🇭
backslash
2026-01-24 15:10:03
(4 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2026-01-21 03:06:00
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 104.207.32.48 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.207.32.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 20 22:05:46.895952 2026] [security2:error] [pid 26173:tid 26173] [client 104.207.32.48:37391] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bsa1688.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bsa1688.com"] [uri "/[email protected] "] [unique_id "aXBCis6CIM70xRI79mAyjgAAAC4"], referer: http://bsa1688.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
MAGIC
2026-01-01 02:01:26
(5 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2025-12-30 11:12:07
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 104.207.32.48 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.207.32.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 30 06:12:00.440509 2025] [security2:error] [pid 18118:tid 18118] [client 104.207.32.48:14489] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||brickyardinn.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "brickyardinn.com"] [uri "/mail to: [email protected] "] [unique_id "aVOzgADj60zf73FyqgeKjgAAABc"], referer: http://brickyardinn.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
Burayot
2025-12-26 05:30:26
(5 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.32.48 (US/United States/-): ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.32.48 (US/United States/-): 1 in the last 3600 secs
show less
Web App Attack
2025-12-23 19:25:59
(5 months ago)
wordpress-trap
Web App Attack
🇺🇸
TPI-Abuse
2025-12-09 14:33:47
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 104.207.32.48 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 104.207.32.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 09 09:33:41.009496 2025] [security2:error] [pid 18119:tid 18119] [client 104.207.32.48:12117] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.babylontravelone.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.babylontravelone.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aTgzRQ-HdlhPVLGfvR8x_wAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-12-03 22:59:14
(6 months ago)
botnet
DDoS Attack
🇪🇸
10dencehispahard SL
2025-11-19 06:55:39
(6 months ago)
WP probing for vulnerabilities
Hacking
Exploited Host
2025-10-31 20:41:33
(7 months ago)
[redacted] 104.207.32.48 - - [31/Oct/2025:21:40:50 +0100] "POST /xmlrpc.php HTTP/2.0" 200 426 "-" "M ...
show more
[redacted] 104.207.32.48 - - [31/Oct/2025:21:40:50 +0100] "POST /xmlrpc.php HTTP/2.0" 200 426 "-" "Mozilla/5.0 (Linux; Android 7.0; Moto G (4) Build/NPJS25.93-14-8.1-9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36"
[redacted] 104.207.32.48 - - [31/Oct/2025:21:40:51 +0100] "POST /xmlrpc.php HTTP/2.0" 200 426 "-" "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0"
[redacted] 104.207.32.48 - - [31/Oct/2025:21:40:52 +0100] "POST /xmlrpc.php HTTP/2.0" 200 426 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
[redacted] 104.207.32.48 - - [31/Oct/2025:21:41:03 +0100] "POST /xmlrpc.php HTTP/2.0" 200 426 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/16A366 Instagram 65.0.0.12.86 (iPhone9,3; iOS 12_0; es_CO; es-CO; scale=2.00; gamut=wide; 750x133
...
show less
Hacking
Web App Attack
🇦🇺
AWW-Admin
2025-10-29 13:54:20
(7 months ago)
(wordpress) Failed wordpress login from 104.207.32.48 (US/United States/-)
Brute-Force
2025-10-19 16:08:08
(7 months ago)
Attempted brute force login to web vpn 36 time(s); last attempt for 2025.10.19 is noted in report ti ...
show more
Attempted brute force login to web vpn 36 time(s); last attempt for 2025.10.19 is noted in report timestamp
show less
Hacking
Brute-Force
2025-10-18 23:19:13
(7 months ago)
Attempted brute force login to web vpn 72 time(s); last attempt for 2025.10.18 is noted in report ti ...
show more
Attempted brute force login to web vpn 72 time(s); last attempt for 2025.10.18 is noted in report timestamp
show less
Hacking
Brute-Force
🇨🇦
wil.com
2025-10-18 06:03:38
(7 months ago)
GlobalProtect login attempts with user clasolis.
VPN IP
Brute-Force