🇨🇳
ThreatBook.io
2025-03-19 23:30:19
(1 year ago)
ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/104.244.78.132
SSH
🇦🇺
oncord
2025-03-18 13:33:06
(1 year ago)
Form spam
Web Spam
🇩🇪
Packets-Decreaser.NET
2025-03-18 09:56:30
(1 year ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
rjdefrancisco
2025-03-18 07:06:04
(1 year ago)
Unwanted traffic detected by honeypot on March 17, 2025: brute force and hacking attacks (2 over ssh ...
show more
Unwanted traffic detected by honeypot on March 17, 2025: brute force and hacking attacks (2 over ssh).
show less
Port Scan
Brute-Force
SSH
🇺🇸
kemonos.net
2025-03-18 04:54:59
(1 year ago)
2025-03-18T04:54:58.681181+00:00 vultr sshd[146076]: Failed password for root from 104.244.78.132 po ...
show more
2025-03-18T04:54:58.681181+00:00 vultr sshd[146076]: Failed password for root from 104.244.78.132 port 53328 ssh2
2025-03-18T04:54:56.824683+00:00 vultr sshd[146075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.78.132 user=root
2025-03-18T04:54:58.681299+00:00 vultr sshd[146075]: Failed password for root from 104.244.78.132 port 53322 ssh2
...
show less
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-03-17 21:01:13
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 104.244.78.132 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.244.78.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 17 17:01:07.827119 2025] [security2:error] [pid 7065:tid 7065] [client 104.244.78.132:42522] [client 104.244.78.132] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||oruhu.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "oruhu.org"] [uri "/hu.sql"] [unique_id "Z9iNk6IvEnZ2XB_cX9i_ywAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
spam.must.die
2025-03-17 08:19:46
(1 year ago)
IP triggered category <category>
Web App Attack
🇺🇸
TPI-Abuse
2025-03-17 08:02:23
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 104.244.78.132 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.244.78.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 17 04:02:16.278463 2025] [security2:error] [pid 27775:tid 27775] [client 104.244.78.132:54392] [client 104.244.78.132] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rotentendales.com|F|2"] [data ".backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rotentendales.com"] [uri "/wp-config.backup"] [unique_id "Z9fXCLmyOV5qF4f6QS83bAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
cma.pl
2025-03-17 05:39:16
(1 year ago)
Mar 17 06:39:14 serv248043 sshd[2584564]: pam_unix(sshd:auth): authentication failure; logname= uid= ...
show more
Mar 17 06:39:14 serv248043 sshd[2584564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.78.132 user=root
Mar 17 06:39:16 serv248043 sshd[2584564]: Failed password for root from 104.244.78.132 port 39466 ssh2
...
show less
Brute-Force
SSH
🇦🇺
oncord
2025-03-16 18:10:57
(1 year ago)
Form spam
Web Spam
🇺🇸
TPI-Abuse
2025-03-13 06:55:23
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 104.244.78.132 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.244.78.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 13 02:55:19.073078 2025] [security2:error] [pid 8293:tid 8293] [client 104.244.78.132:60446] [client 104.244.78.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "geodogs.org"] [uri "/wp-config.php.maj"] [unique_id "Z9KBVy84rW2DlSvl52b_VgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
kais-universum.de
2025-03-08 17:05:14
(1 year ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇦🇺
OldNGrey
2025-03-06 20:52:00
(1 year ago)
Contact Us form exploit using pwned email address
Web Spam
Email Spam
Web App Attack