🇫🇷
dynamix
2026-05-24 22:31:51
(3 weeks ago)
WordPress wp-login.php Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-24 22:30:37
(3 weeks ago)
(mod_security) mod_security (id:240335) triggered by 181.41.206.106 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 181.41.206.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 24 18:30:30.272709 2026] [security2:error] [pid 16804:tid 16804] [client 181.41.206.106:32193] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 181.41.206.106 (+1 hits since last alert)|crr-construction.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "crr-construction.com"] [uri "/xmlrpc.php"] [unique_id "ahN8Bnie0RSX9EDZPqBUSQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-24 20:48:14
(3 weeks ago)
(mod_security) mod_security (id:240335) triggered by 181.41.206.106 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 181.41.206.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 24 16:48:09.211460 2026] [security2:error] [pid 25236:tid 25236] [client 181.41.206.106:40495] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 181.41.206.106 (+1 hits since last alert)|desertalfas.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "desertalfas.org"] [uri "/xmlrpc.php"] [unique_id "ahNkCfWlJSverm0Ywl2sbAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
applemooz
2026-05-24 20:32:24
(3 weeks ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-24 20:22:40
(3 weeks ago)
(mod_security) mod_security (id:240335) triggered by 181.41.206.106 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 181.41.206.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 24 16:22:34.950733 2026] [security2:error] [pid 23064:tid 23064] [client 181.41.206.106:64306] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 181.41.206.106 (+1 hits since last alert)|iconconstructors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "iconconstructors.com"] [uri "/xmlrpc.php"] [unique_id "ahNeCsG-r6MquAr_mwpZ0AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-05-24 20:19:53
(3 weeks ago)
Blocked by CSF 13 firewall - Rule: WPLOGIN
US/United States/-
Web App Attack
🇩🇪
FeG Deutschland
2026-05-24 20:16:24
(3 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 25
Exploited Host
Web App Attack
🇩🇪
LRob.fr
2026-05-24 20:15:05
(3 weeks ago)
WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-05-24 20:10:03
(3 weeks ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇺🇸
MPL
2026-04-19 20:42:51
(1 month ago)
tcp/7001 (2 or more attempts)
Port Scan
🇺🇸
Cyber Crusader
2026-04-18 18:43:47
(1 month ago)
Hundreds of Attempts (at least) to Connect to and Access Firewall Ports
Port Scan
Hacking
Brute-Force
🇺🇸
cazae
2026-04-17 23:56:42
(1 month ago)
Unauthorized attempt on debian [7001/tcp]
Source port: 20611
TTL: 116
Packet length: 52
TOS: 0x08
h ...
show more
Unauthorized attempt on debian [7001/tcp]
Source port: 20611
TTL: 116
Packet length: 52
TOS: 0x08
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇨🇦
Slackin' Jack
2026-04-17 22:33:14
(1 month ago)
Triggered honeypot on port 7001. (181.41.206.106)
Port Scan
🇺🇸
MPL
2026-04-17 21:08:24
(1 month ago)
tcp/7001 (96 or more attempts)
Port Scan
🇺🇸
xmission.com
2025-10-31 00:40:04
(7 months ago)
Blocked by UFW (TCP on 53194)
Source port: 52878
TTL: 121
Packet length: 52
TOS: 0x08
This report ( ...
show more
Blocked by UFW (TCP on 53194)
Source port: 52878
TTL: 121
Packet length: 52
TOS: 0x08
This report (for 181.41.206.106) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan