2025-10-12 07:12:00
(1 year ago)
Unauthorized connection attempt
Brute-Force
🇺🇸
TPI-Abuse
2025-09-10 03:14:28
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 156.233.88.213 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 156.233.88.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 09 23:14:21.782278 2025] [security2:error] [pid 20098:tid 20098] [client 156.233.88.213:37515] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.bright-enterprise.com.saadeh.ws|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bright-enterprise.com.saadeh.ws"] [uri "/s3cmd.ini"] [unique_id "aMDtDS0w1a0SUFDuJ-m9AAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-07 02:08:01
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 156.233.88.213 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 156.233.88.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 06 22:07:57.798669 2025] [security2:error] [pid 29651:tid 29651] [client 156.233.88.213:46111] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "general-electric.pamplonaserviciotecnico.com"] [uri "/config.php%7C/.env%7Csettings.py"] [unique_id "aLzo_f0mDFRC0G-SiDX_zAAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-06 15:42:55
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 156.233.88.213 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 156.233.88.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 06 11:42:47.288852 2025] [security2:error] [pid 29921:tid 29945] [client 156.233.88.213:45737] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.hawk-av.jd-web-designs.com"] [uri "/config.php%7C/.env%7Csettings.py"] [unique_id "aLxWd2LPyTj8IUt_6kL4lQAAAFQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
SOC [GOLINE SA]
2025-08-27 17:26:43
(1 year ago)
Security Alert: 1 ModSecurity rule violation(s) from 156.233.88.213; Ports: *; Evidence: [Wed Aug 27 ...
show more
Security Alert: 1 ModSecurity rule violation(s) from 156.233.88.213; Ports: *; Evidence: [Wed Aug 27 19:26:41.729838 2025] [security2:error] [pid 2416122:tid 2416202] [client 156.233.88.213:51685] [client 156.233.88.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "wp-login\\\\.php" at REQUEST_URI. [file "/etc/modsecurity/modsecurity.conf"] [line "229"] [id "92010"] [hostname "www.goline.ch"] [uri "/wp-login.php"] [unique_id "aK8_0T6zv9R3f6950CHOvgAAAEA"], referer: https://www.google.com
show less
Web App Attack
🇩🇪
dayda.net
2025-08-20 07:53:10
(1 year ago)
'
Bad Web Bot
🇩🇪
sbajic
2025-07-19 05:39:33
(1 year ago)
Jul 19 07:39:30 eos sshd-session[32459]: User root from 156.233.88.213 not allowed because none of u ...
show more
Jul 19 07:39:30 eos sshd-session[32459]: User root from 156.233.88.213 not allowed because none of user's groups are listed in AllowGroups
Jul 19 07:39:32 eos sshd-session[32459]: error: PAM: Authentication failure for illegal user root from 156.233.88.213
Jul 19 07:39:32 eos sshd-session[32459]: Failed keyboard-interactive/pam for invalid user root from 156.233.88.213 port 40557 ssh2
...
show less
Brute-Force
SSH
🇫🇮
JimArchon72
2025-07-18 17:39:59
(1 year ago)
2025-07-18 17:39:59 - Port Scan From IP: 156.233.88.213
Port Scan
SSH
2025-07-13 06:37:23
(1 year ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇲🇾
syokadmin
2025-07-12 20:56:00
(1 year ago)
(cpanel) Failed cPanel login from 156.233.88.213 (BR/Brazil/-): 1 in the last 3600 secs
Brute-Force
Web App Attack
🇩🇪
Bigbear3
2025-07-11 03:01:10
(1 year ago)
Report-by-bigbear3
Brute-Force
SSH
🇺🇸
hostseries
2025-07-04 13:47:16
(1 year ago)
Trigger: LF_DISTATTACK
Brute-Force
🇫🇮
JimArchon72
2025-07-04 01:48:30
(1 year ago)
2025-07-04 01:48:30 - Port Scan From IP: 156.233.88.213
Port Scan
SSH
🇳🇱
EGP Abuse Dept
2025-07-01 07:43:56
(1 year ago)
Unauthorized connection to SSH port 22
Port Scan
Hacking
SSH
2025-06-29 20:03:00
(1 year ago)
156.233.88.213 (BR/Brazil/-), 10 distributed sshd attacks on account [redacted]
Brute-Force
SSH