|
🇩🇪
xavier-momain.eu
|
|
CrowdSec ban — scenario: ssh:bruteforce
|
Brute-Force
SSH
|
|
🇹🇷
neron
|
|
CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall
|
Hacking
Web App Attack
|
|
🇹🇷
neron
|
|
CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall
|
Hacking
Web App Attack
|
|
🇦🇺
electronico
|
|
191.6.0.78 - - [04/Sep/2026:19:27:19 +1100] "GET /wp-login.php HTTP/1.1" 301 443 "-" "Mozilla/5.0 (X81; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/80.0.3957.163 Safari/537.36"
191.6.0.78 - - [04/Sep/2026:19:27:22 +1100] "GET ...
show more
191.6.0.78 - - [04/Sep/2026:19:27:19 +1100] "GET /wp-login.php HTTP/1.1" 301 443 "-" "Mozilla/5.0 (X81; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/80.0.3957.163 Safari/537.36"
191.6.0.78 - - [04/Sep/2026:19:27:22 +1100] "GET /wp-login.php HTTP/1.1" 404 5830 "-" "Mozilla/5.0 (X81; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/80.0.3957.163 Safari/537.36"
191.6.0.78 - - [04/Sep/2026:19:27:22 +1100] "GET /wp-admin/ HTTP/1.1" 301 437 "https://electronico.nc/wp-login.php" "Mozilla/5.0 (X81; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/80.0.3957.163 Safari/537.36"
...
show less
|
Brute-Force
Web App Attack
|
|
🇨🇦
updown.io
|
|
2026-09-03T17:26:41.268778+00:00 tor.updn.io sshd[612047]: Failed password for root from 191.6.0.78 port 43752 ssh2
2026-09-03T17:26:43.548160+00:00 tor.updn.io sshd[612263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ...
show more
2026-09-03T17:26:41.268778+00:00 tor.updn.io sshd[612047]: Failed password for root from 191.6.0.78 port 43752 ssh2
2026-09-03T17:26:43.548160+00:00 tor.updn.io sshd[612263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.6.0.78 user=root
2026-09-03T17:26:46.054083+00:00 tor.updn.io sshd[612263]: Failed password for root from 191.6.0.78 port 37732 ssh2
2026-09-03T17:26:48.841779+00:00 tor.updn.io sshd[612549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.6.0.78 user=root
2026-09-03T17:26:50.367691+00:00 tor.updn.io sshd[612549]: Failed password for root from 191.6.0.78 port 37742 ssh2
...
show less
|
Brute-Force
SSH
|
|
🇩🇪
EGP Abuse Dept
|
|
Scanning for web/db/file exploits on www.opticus.nl
|
SQL Injection
Bad Web Bot
Web App Attack
|
|
🇨🇦
DRI
|
|
Web attack/Malicious activity detected
|
Web App Attack
|
|
🇫🇷
smtp.com.es
|
|
Brute force attempt.
|
Brute-Force
Email Spam
|
|
🇧🇷
wagnerbocchi
|
|
2026-08-13T15:54:57.666596-03:00 pentest sshd[3063120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.6.0.78 user=root
2026-08-13T15:54:59.094350-03:00 pentest sshd[3063120]: Failed password for root fro ...
show more
2026-08-13T15:54:57.666596-03:00 pentest sshd[3063120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.6.0.78 user=root
2026-08-13T15:54:59.094350-03:00 pentest sshd[3063120]: Failed password for root from 191.6.0.78 port 34224 ssh2
2026-08-13T15:55:00.949587-03:00 pentest sshd[3063127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.6.0.78 user=root
2026-08-13T15:55:02.788837-03:00 pentest sshd[3063127]: Failed password for root from 191.6.0.78 port 37272 ssh2
...
show less
|
Brute-Force
SSH
|
|
🇩🇪
ghostwarriors
|
|
Unauthorized connection attempt detected, SSH Brute-Force
|
Brute-Force
Port Scan
SSH
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 191.6.0.78 (191-6-0-78.betininet.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 05:51:06.788768 2026] [security2:error] [pid 2291774:tid 2291774] [cl ...
show more
(mod_security) mod_security (id:225170) triggered by 191.6.0.78 (191-6-0-78.betininet.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 05:51:06.788768 2026] [security2:error] [pid 2291774:tid 2291774] [client 191.6.0.78:59870] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mdsshop.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mdsshop.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "anWqiomIOCZEYokfYeExMwAAACY"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
FeG Deutschland
|
|
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
|
Exploited Host
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 191.6.0.78 (191-6-0-78.betininet.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 15:12:19.103907 2026] [security2:error] [pid 3621509:tid 3621509] [cl ...
show more
(mod_security) mod_security (id:210730) triggered by 191.6.0.78 (191-6-0-78.betininet.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 15:12:19.103907 2026] [security2:error] [pid 3621509:tid 3621509] [client 191.6.0.78:36740] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||williamfitzsimmons.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "williamfitzsimmons.com"] [uri "/dump.sql"] [unique_id "adaok8AuodRV-rqc2R6m-gAAAAo"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
Anonymous
|
|
This IP was involved in a brute force and password spray attack.
|
Brute-Force
Web App Attack
|
|
🇿🇦
IrisFlower
|
|
Unauthorized connection attempt detected from IP address 191.6.0.78 to port 22 [J]
|
Port Scan
Hacking
|
