🇺🇸
rdpguard.com
2026-05-28 10:06:47
(1 week ago)
RdpGuard detected brute-force attempt on HTTP
Brute-Force
🇧🇪
cmbplf
2026-05-24 08:28:21
(1 week ago)
847 requests with url.path //xmlrpc.php
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-02-14 14:08:23
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 09:08:17.496610 2026] [security2:error] [pid 22156:tid 22156] [client 104.207.34.17:43259] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||zodiacwin.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "zodiacwin.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZCB0aCrp8MU0O0o37QhWQAAAAM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-12-15 03:14:25
(5 months ago)
botnet
DDoS Attack
🇺🇸
TPI-Abuse
2025-12-08 09:13:24
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 08 04:13:20.135890 2025] [security2:error] [pid 15773:tid 15773] [client 104.207.34.17:24675] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rosecityexpress.com"] [uri "/.env"] [unique_id "aTaWsJhxClU-oofUZlUN8gAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-08 04:53:00
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 23:52:52.000615 2025] [security2:error] [pid 25177:tid 25177] [client 104.207.34.17:23207] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fitnessgearmagazine.com"] [uri "/.svn/wc.db"] [unique_id "aTZZpCqanH4dArTCdUp6kgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
jjnxpct
2025-12-07 04:54:13
(5 months ago)
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ...
show more
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.env (Rule ID: 930130) - Restricted File Access Attempt [Suspicious: .env found within REQUEST_FILENAME: /.env]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-12-06 10:05:05
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 06 05:04:58.626364 2025] [security2:error] [pid 3965:tid 3965] [client 104.207.34.17:38669] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "basse.me"] [uri "/.svn/wc.db"] [unique_id "aTP_yvgPhQ59N0WO6vsOPQAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-05 10:25:12
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 05 05:25:03.253353 2025] [security2:error] [pid 28565:tid 28565] [client 104.207.34.17:22591] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "armorcorp.com"] [uri "/.git/HEAD"] [unique_id "aTKy_wQyHcZ7b8cxlNOnxQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-05 08:40:51
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 05 03:40:47.954999 2025] [security2:error] [pid 29941:tid 29941] [client 104.207.34.17:48731] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "copiersraleigh.com"] [uri "/.git/HEAD"] [unique_id "aTKaj_e-p4Y_cwLZsK2EAQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-05 06:45:46
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.34.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 05 01:45:44.217228 2025] [security2:error] [pid 25604:tid 25608] [client 104.207.34.17:14385] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mecconsultant.com"] [uri "/.svn/wc.db"] [unique_id "aTJ_mJj7o2nNVMhsi-9XpwAAAII"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-29 03:05:48
(6 months ago)
botnet
DDoS Attack
2025-11-14 03:50:27
(6 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇨🇦
wil.com
2025-10-28 22:12:49
(7 months ago)
GlobalProtect login attempts with user poojpasu.
VPN IP
Brute-Force
2025-10-19 06:07:28
(7 months ago)
Attempted brute force login to web vpn 108 time(s); last attempt for 2025.10.19 is noted in report t ...
show more
Attempted brute force login to web vpn 108 time(s); last attempt for 2025.10.19 is noted in report timestamp
show less
Hacking
Brute-Force