🇮🇩
bps-statistics
2026-08-11 15:31:21
(2 weeks ago)
WP Login Scan Activities: "2026-08-11T22:31:21.568+07:00" "/wp-login.php" "199.96.166.217" "Mozilla/ ...
show more
WP Login Scan Activities: "2026-08-11T22:31:21.568+07:00" "/wp-login.php" "199.96.166.217" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15"
show less
Web App Attack
🇨🇦
DRI
2026-07-17 04:08:53
(1 month ago)
Web attack/Malicious activity detected
Web App Attack
2026-06-29 05:33:57
(1 month ago)
WordPress HTTP Brute Force Login Attempt.
Brute-Force
2026-04-30 04:31:55
(3 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇺🇸
TPI-Abuse
2026-04-29 14:22:22
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 199.96.166.217 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 199.96.166.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 10:22:14.799800 2026] [security2:error] [pid 21991:tid 21991] [client 199.96.166.217:32691] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.cycon.kleens-uk.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.cycon.kleens-uk.com"] [uri "/s3cmd.ini"] [unique_id "afIUFq2LuXQAhi12HE_E4gAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-28 05:59:46
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 199.96.166.217 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 199.96.166.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 01:59:42.534761 2026] [security2:error] [pid 2513:tid 2513] [client 199.96.166.217:47515] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.itibitico.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.itibitico.com"] [uri "/s3cmd.ini"] [unique_id "afBMzumU4BovYLQXAwXHiQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
SCHAPPY
2026-04-27 06:05:45
(3 months ago)
Critical web app attack detected. HTTP header is restricted by policy (/accept-charset/)
Web App Attack
🇺🇸
TPI-Abuse
2026-04-26 19:59:42
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 199.96.166.217 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 199.96.166.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 15:59:37.404652 2026] [security2:error] [pid 3549:tid 3565] [client 199.96.166.217:57923] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||webprog.howiek.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "webprog.howiek.com"] [uri "/s3cmd.ini"] [unique_id "ae5uqQMQHvnObZ357mNkdAAAAE0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-02-14 02:32:25
(6 months ago)
Fail2Ban banned 199.96.166.217 for security violations in jail wp-armour. Log: 2026/02/14 02:32:24 [ ...
show more
Fail2Ban banned 199.96.166.217 for security violations in jail wp-armour. Log: 2026/02/14 02:32:24 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 199.96.166.217 | Target: wplogin" , client: 199.96.166.217, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇫🇷
Tilellit.PRO
2026-02-13 16:51:27
(6 months ago)
Fail2Ban banned 199.96.166.217 for security violations in jail wp-armour. Log: 2026/02/13 16:51:25 [ ...
show more
Fail2Ban banned 199.96.166.217 for security violations in jail wp-armour. Log: 2026/02/13 16:51:25 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 199.96.166.217 | Target: wplogin" , client: 199.96.166.217, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇱🇻
garmtech.com
2025-12-06 14:23:14
(8 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 16-23.199.96.166.217.web-spamm ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 16-23.199.96.166.217.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇺🇸
octageeks.com
2025-11-11 05:12:49
(9 months ago)
Wordpress malicious attack:[octaflood]
Web App Attack
🇨🇭
backslash
2025-11-10 14:00:38
(9 months ago)
block ruleset 486D2EE5E731CC049D1E480D68D04DFFE28AADF1
Bad Web Bot
🇺🇸
TPI-Abuse
2025-10-16 08:27:22
(10 months ago)
(mod_security) mod_security (id:210350) triggered by 199.96.166.217 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 199.96.166.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 16 04:27:19.215175 2025] [security2:error] [pid 12347:tid 12347] [client 199.96.166.217:30001] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||williambarfoot.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "williambarfoot.com"] [uri "/"] [unique_id "aPCsZ-Rm77ocWZM3pBlHpQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack