|
🇩🇪
raph
|
|
[Wordpress] crawler /wp-admin/*, /wp-content/*, etc.
|
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:240335) triggered by 191.96.227.49 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 191.96.227.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 01:18:13.144035 2026] [security2:error] [pid 29639:tid 29639] [client 191.96.227.49:38528] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 191.96.227.49 (+1 hits since last alert)|brazilianbottom.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "brazilianbottom.com"] [uri "/xmlrpc.php"] [unique_id "ah-5FegCBx_xh0rnawcIsQAAAAA"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇧🇪
Saec
|
|
Jarvis auto-ban: CF honeypot path /wp-login.php (1× on saec.me)
|
Port Scan
Web App Attack
|
|
|
🇫🇷
UM3
|
|
Exim Auth Failed
|
Brute-Force
|
|
|
🇮🇹
VHosting
|
|
Detected mail brute force attack from 4 different servers
|
Brute-Force
|
|
|
Anonymous
|
|
Jan 23 00:27:48 mx1 postfix/submission/smtpd[12191]: warning: unknown[191.96.227.49]: SASL PLAIN aut ...
show more
Jan 23 00:27:48 mx1 postfix/submission/smtpd[12191]: warning: unknown[191.96.227.49]: SASL PLAIN authentication failed:
Jan 23 00:27:54 mx1 postfix/submission/smtpd[12191]: warning: unknown[191.96.227.49]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jan 23 00:28:01 mx1 postfix/smtps/smtpd[12194]: warning: unknown[191.96.227.49]: SASL PLAIN authentication failed:
...
show less
|
Brute-Force
|
|
|
🇺🇸
bigscoots.com
|
|
(smtpauth) Failed SMTP AUTH login from 191.96.227.49 (US/United States/-): 5 in the last 3600 secs; ...
show more
(smtpauth) Failed SMTP AUTH login from 191.96.227.49 (US/United States/-): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2026-01-22 18:15:12 dovecot_plain authenticator failed for H=([10.43.18.68]) [191.96.227.49]:61328: 535 Incorrect authentication data ([email protected])
2026-01-22 18:15:18 dovecot_login authenticator failed for H=([10.43.18.68]) [191.96.227.49]:61328: 535 Incorrect authentication data ([email protected])
2026-01-22 18:15:24 dovecot_plain authenticator failed for H=([10.43.18.68]) [191.96.227.49]:40604: 535 Incorrect authentication data ([email protected])
2026-01-22 18:15:30 dovecot_login authenticator failed for H=([10.43.18.68]) [191.96.227.49]:40604: 535 Incorrect authentication data ([email protected])
2026-01-22 18:15:39 dovecot_plain authenticator failed for H=([10.43.18.68]) [191.96.227.49]:11779: 535 Incorrect authentication data ([email protected])
show less
|
Brute-Force
SSH
|
|
|
Anonymous
|
|
(smtpauth) Failed SMTP AUTH login from 191.96.227.49 (US/United States/-)
|
Brute-Force
|
|
|
🇫🇷
Sysadmin Peter
|
|
Jan 22 23:29:57 mail postfix/smtpd[173045]: warning: unknown[191.96.227.49]: SASL CRAM-MD5 authentic ...
show more
Jan 22 23:29:57 mail postfix/smtpd[173045]: warning: unknown[191.96.227.49]: SASL CRAM-MD5 authentication failed: authentication failure
Jan 22 23:29:57 mail postfix/smtpd[173045]: warning: unknown[191.96.227.49]: SASL PLAIN authentication failed: authentication failure
...
show less
|
Email Spam
|
|
|
🇩🇪
rh24
|
|
(smtpauth) Failed SMTP AUTH login from 191.96.227.49 (US/United States/-)
|
Brute-Force
|
|
|
🇺🇸
bigscoots.com
|
|
(smtpauth) Failed SMTP AUTH login from 191.96.227.49 (US/United States/-): 5 in the last 3600 secs; ...
show more
(smtpauth) Failed SMTP AUTH login from 191.96.227.49 (US/United States/-): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2026-01-22 15:06:46 dovecot_plain authenticator failed for H=([10.43.18.68]) [191.96.227.49]:30096: 535 Incorrect authentication data ([email protected])
2026-01-22 15:06:52 dovecot_login authenticator failed for H=([10.43.18.68]) [191.96.227.49]:30096: 535 Incorrect authentication data ([email protected])
2026-01-22 15:06:58 dovecot_plain authenticator failed for H=([10.43.18.68]) [191.96.227.49]:21589: 535 Incorrect authentication data ([email protected])
2026-01-22 15:07:04 dovecot_login authenticator failed for H=([10.43.18.68]) [191.96.227.49]:21589: 535 Incorrect authentication data ([email protected])
2026-01-22 15:07:12 dovecot_plain authenticator failed for H=([10.43.18.68]) [191.96.227.49]:19059: 535 Incorrect authentication data ([email protected])
show less
|
Brute-Force
SSH
|
|
|
🇩🇪
marzzzello
|
|
Ports: 8x 56701
|
Port Scan
|
|
|
Anonymous
|
|
High Number of Ports and High Connection Diversity
|
Port Scan
|
|
|
🇩🇪
marzzzello
|
|
Ports: 25x 56134
|
Port Scan
|
|
|
🇦🇺
MAGIC
|
|
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
|
DDoS Attack
Bad Web Bot
|
|