🇩🇪
ghostwarriors
2026-04-30 05:20:12
(1 month ago)
Unauthorized connection attempt detected, SSH Brute-Force
Brute-Force
Port Scan
SSH
🇺🇸
TPI-Abuse
2026-04-30 04:51:28
(1 month ago)
(mod_security) mod_security (id:218420) triggered by 141.98.198.24 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:218420) triggered by 141.98.198.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 00:51:21.491078 2026] [security2:error] [pid 9388:tid 9388] [client 141.98.198.24:44608] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||192.64.150.244:80|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.244"] [uri "/hello.world"] [unique_id "afLfyTPq0jWfEERH3qimWwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
wlt-blocker
2026-04-30 04:47:06
(1 month ago)
Attempts to access SSH server with wrong credentials
SSH
🇩🇪
NetWatch
2026-04-30 04:46:08
(1 month ago)
The IP 141.98.198.24 tried multiple SSH_BRUTE_FORCE logins
Brute-Force
🇺🇸
cxnky
2026-04-30 04:43:36
(1 month ago)
2026-04-30T04:43:02.257431+00:00 graylog sshd[3796370]: pam_unix(sshd:auth): authentication failure; ...
show more
2026-04-30T04:43:02.257431+00:00 graylog sshd[3796370]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.198.24
2026-04-30T04:43:04.224168+00:00 graylog sshd[3796370]: Failed password for invalid user admin from 141.98.198.24 port 59108 ssh2
2026-04-30T04:43:35.529799+00:00 graylog sshd[3796506]: Invalid user orangepi from 141.98.198.24 port 51610
...
show less
Brute-Force
SSH
🇺🇸
COMPLEX
2026-04-30 04:37:33
(1 month ago)
Unsolicited TCP traffic | Action: DROP | Port 2222
Brute-Force
🇫🇷
ingroscart.it
2026-04-30 04:33:57
(1 month ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 141.98.198.24 (JP/Japan/ ...
show more
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 141.98.198.24 (JP/Japan/-)
show less
Port Scan
🇺🇸
yzfdude1
2026-04-30 04:31:18
(1 month ago)
Apr 29 22:31:15 b146-10 sshd[1149891]: Invalid user orangepi from 141.98.198.24 port 48638
Apr 29 22 ...
show more
Apr 29 22:31:15 b146-10 sshd[1149891]: Invalid user orangepi from 141.98.198.24 port 48638
Apr 29 22:31:15 b146-10 sshd[1149891]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.198.24
Apr 29 22:31:17 b146-10 sshd[1149891]: Failed password for invalid user orangepi from 141.98.198.24 port 48638 ssh2
...
show less
Brute-Force
SSH
🇫🇮
bittiguru.fi
2026-04-30 04:25:42
(1 month ago)
Apr 30 07:25:08 docker2 sshd[261470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 eu ...
show more
Apr 30 07:25:08 docker2 sshd[261470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.198.24
Apr 30 07:25:10 docker2 sshd[261470]: Failed password for invalid user admin from 141.98.198.24 port 33294 ssh2
Apr 30 07:25:42 docker2 sshd[261518]: Invalid user orangepi from 141.98.198.24 port 39274
...
show less
Brute-Force
SSH
🇧🇷
SOC PR
2026-04-30 04:21:25
(1 month ago)
IPS: Apache HTTP Server Directory Traversal.
Web App Attack
🇺🇸
Deltron3030
2026-04-30 04:18:00
(1 month ago)
SSH brute-force attempt from 141.98.198.24 blocked by Detroit.
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-04-30 04:16:10
(1 month ago)
(mod_security) mod_security (id:218420) triggered by 141.98.198.24 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:218420) triggered by 141.98.198.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 00:16:03.639208 2026] [security2:error] [pid 22994:tid 22994] [client 141.98.198.24:52700] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||192.64.150.248:80|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.248"] [uri "/hello.world"] [unique_id "afLXg7sHsRtqZIq9BH7WpwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
yukari
2026-04-30 04:14:34
(1 month ago)
SSH brute-force login attempt, tcp/22. Repeated failed authentication.
SSH
Brute-Force
🇨🇦
Slackin' Jack
2026-04-30 04:14:09
(1 month ago)
Triggered honeypot on port 2222. (141.98.198.24)
Port Scan
🇦🇹
urnilxfgbez
2024-10-16 22:45:00
(1 year ago)
Last 24 Hours suspicious: (DPT=445|DPT=3389|DPT=22|DPT=3306|DPT=8080|DPT=23|DPT=5900|DPT=1433)
Port Scan