๐ซ๐ท
Kimax
2026-01-10 19:11:33
(5 months ago)
RdpGuard detected brute-force attempt on RDP
Brute-Force
๐ซ๐ฎ
cbo
2025-12-02 11:51:21
(6 months ago)
RDP brute-force tespit edildi: 5 baลarฤฑsฤฑz giriล.
Brute-Force
๐ฉ๐ช
Freenex1911
2025-12-02 11:47:26
(6 months ago)
2025-12-02T11:47:24Z - RDP login from 138.199.18.136 failed multiple times.
Brute-Force
๐ท๐ด
hostar
2025-11-15 09:07:50
(7 months ago)
(smtpauth) Failed SMTP AUTH login from 138.199.18.136 (DE/Germany/unn-138-199-18-136.datapacket.com) ...
show more
(smtpauth) Failed SMTP AUTH login from 138.199.18.136 (DE/Germany/unn-138-199-18-136.datapacket.com): 5 in the last 43200 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: Nov 15 01:13:21 srv2 postfix/smtpd[1248660]: warning: unknown[138.199.18.136]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Nov 15 06:30:57 srv2 postfix/smtpd[1393877]: warning: unknown[138.199.18.136]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Nov 15 06:47:11 srv2 postfix/smtpd[1396503]: warning: unknown[138.199.18.136]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Nov 15 10:00:31 srv2 postfix/smtpd[1428635]: warning: unknown[138.199.18.136]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Nov 15 11:07:47 srv2 postfix/smtpd[1439796]: warning: unknown[138.199.18.136]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
show less
Port Scan
๐บ๐ธ
TPI-Abuse
2025-11-09 05:02:03
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 138.199.18.136 (unn-138-199-18-136.datapacket.c ...
show more
(mod_security) mod_security (id:225170) triggered by 138.199.18.136 (unn-138-199-18-136.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 09 00:01:59.203414 2025] [security2:error] [pid 7470:tid 7470] [client 138.199.18.136:27735] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||odessatexas.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "odessatexas.us"] [uri "/wp-json/wp/v2/users"] [unique_id "aRAgR4dUl1us7mPiewuDiwAAAAI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฉ๐ช
Freenex1911
2025-11-08 20:46:37
(7 months ago)
2025-11-08T20:46:36Z - RDP login from 138.199.18.136 failed multiple times.
Brute-Force
๐บ๐ธ
TPI-Abuse
2025-11-08 19:14:07
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 138.199.18.136 (unn-138-199-18-136.datapacket.c ...
show more
(mod_security) mod_security (id:225170) triggered by 138.199.18.136 (unn-138-199-18-136.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 08 14:14:00.886537 2025] [security2:error] [pid 20389:tid 20424] [client 138.199.18.136:30326] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||pixelpushersdesign.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "pixelpushersdesign.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aQ-WeOFB4xxsWWa-NOj1CAAAANI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
๐จ๐ญ
backslash
2025-11-08 12:10:03
(7 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
๐บ๐ธ
TPI-Abuse
2025-11-08 00:39:37
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 138.199.18.136 (unn-138-199-18-136.datapacket.c ...
show more
(mod_security) mod_security (id:225170) triggered by 138.199.18.136 (unn-138-199-18-136.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 07 19:39:32.664483 2025] [security2:error] [pid 1699:tid 1699] [client 138.199.18.136:12881] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lingafelt.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lingafelt.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aQ6RROlyYoYgbRqn0nQEmgAAABk"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ง๐ช
voormedia
2025-11-07 20:27:44
(7 months ago)
Accessed trap at '/xmlrpc.php'
Web App Attack
๐ฌ๐ง
SilverZippo
2025-11-07 19:45:08
(7 months ago)
Web App Attack
Web App Attack
๐ฉ๐ช
Freenex1911
2025-10-25 07:44:34
(7 months ago)
2025-10-25T07:44:34Z - RDP login from 138.199.18.136 failed multiple times.
Brute-Force
๐ฉ๐ช
DerDoktor
2025-10-14 00:10:06
(8 months ago)
I1013 23:13:57.08525
fail2ban action triggered
Port Scan
Brute-Force
SSH
๐ฐ๐ท
winter
2025-10-13 23:15:54
(8 months ago)
Connection attemp from 138.199.18.136 to port 22
Brute-Force
SSH
๐ฉ๐ช
DoSammy
2025-10-11 19:41:27
(8 months ago)
neu-RDP-Brute-Force
Brute-Force