🇫🇷
masterguru
2026-07-02 02:40:33
(15 hours ago)
(modsec_5040) ModSec 5040: API Basic Auth blocked from 104.207.49.171 (BR/Brazil/-): 1 in the last 3 ...
show more
(modsec_5040) ModSec 5040: API Basic Auth blocked from 104.207.49.171 (BR/Brazil/-): 1 in the last 3600 secs (0-195)
show less
Hacking
🇩🇪
LRob
2026-06-24 01:32:12
(1 week ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇫🇮
inlink.ltd
2026-05-29 09:52:19
(1 month ago)
Known malicious PHP file or CMS probe
Web App Attack
🇨🇳
ThreatBook.io
2026-04-23 23:10:11
(2 months ago)
ThreatBook Intelligence: http_proxy,Gateway more details on https://threatbook.io/ip/104.207.49.171
...
show more
ThreatBook Intelligence: http_proxy,Gateway more details on https://threatbook.io/ip/104.207.49.171
2026-04-23 06:36:38 /default
2026-04-23 06:48:04 /index.html
2026-04-23 06:38:12 /zenoss
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 08:15:56
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 03:15:50.900085 2025] [security2:error] [pid 25211:tid 25211] [client 104.207.49.171:54607] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.worldpeaceholidaycards.com"] [uri "/.env"] [unique_id "aSQUNrO5cyHCcgkvnXqfqAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 07:45:51
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:45:46.465193 2025] [security2:error] [pid 11414:tid 11414] [client 104.207.49.171:42441] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.indoorfreeflight.com"] [uri "/.svn/wc.db"] [unique_id "aSQNKsfjib0MTWjYGPJBdQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 05:43:49
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:43:42.041571 2025] [security2:error] [pid 3473:tid 3473] [client 104.207.49.171:36005] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.pyxelstudios.com"] [uri "/.env"] [unique_id "aSPwjuqNAJnHyYj0VsEwDwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 05:26:41
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:26:31.559010 2025] [security2:error] [pid 15539:tid 15539] [client 104.207.49.171:41879] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.jamesedwardskinner.com"] [uri "/.git/HEAD"] [unique_id "aSPsh_7U_0_GwD406Z9dwwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 04:56:34
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:56:26.491590 2025] [security2:error] [pid 25710:tid 25710] [client 104.207.49.171:18319] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.integrabroadcast.com"] [uri "/.git/HEAD"] [unique_id "aSPlerKSSR70eZJ0zHflMwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 04:24:45
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:24:40.315567 2025] [security2:error] [pid 29526:tid 29526] [client 104.207.49.171:29373] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.theboates.com"] [uri "/.env"] [unique_id "aSPeCHkkshkq3BjxXWmjCQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
applemooz
2025-11-01 12:17:08
(8 months ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-10-28 14:12:24
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 104.207.49.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 28 10:12:17.333077 2025] [security2:error] [pid 23861:tid 23861] [client 104.207.49.171:43767] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||henrietteg.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "henrietteg.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aQDPQU8JfrOOgbI7odMAbwAAAAM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-10-26 09:00:29
(8 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-10-24 06:04:52
(8 months ago)
2025-10-24T08:04:50.325499 localhost.localdomain sshd[871350]: pam_unix(sshd:auth): authentication f ...
show more
2025-10-24T08:04:50.325499 localhost.localdomain sshd[871350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.207.49.171
2025-10-24T08:04:51.950713 localhost.localdomain sshd[871350]: Failed password for invalid user [email protected] from 104.207.49.171 port 14523 ssh2
...
show less
Brute-Force
SSH
🇫🇷
bigorre.org
2025-10-13 01:45:23
(8 months ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot