🇺🇸
avgsmoe
2026-06-07 20:59:10
(10 hours ago)
CROWDSEC offender. Observed 5871 times.
Port Scan
Brute-Force
Web App Attack
🇺🇸
avgsmoe
2026-06-06 20:00:11
(1 day ago)
CROWDSEC offender. Observed 5721 times.
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-06 05:38:14
(2 days ago)
(mod_security) mod_security (id:240335) triggered by 2.56.10.36 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 2.56.10.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 01:38:00.402219 2026] [security2:error] [pid 18920:tid 18920] [client 2.56.10.36:51748] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 2.56.10.36 (+1 hits since last alert)|dwightbrown.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "dwightbrown.com"] [uri "/xmlrpc.php"] [unique_id "aiOyOGyqL8QKJ6wmy39OLwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
avgsmoe
2026-06-05 19:59:10
(2 days ago)
CROWDSEC offender. Observed 5537 times.
Port Scan
Brute-Force
Web App Attack
🇺🇸
avgsmoe
2026-06-04 19:00:18
(3 days ago)
CROWDSEC offender. Observed 5344 times.
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-04 18:02:08
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2.56.10.36 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 2.56.10.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 14:01:55.140754 2026] [security2:error] [pid 20151:tid 20151] [client 2.56.10.36:39490] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.merlinaerospace.com"] [uri "/.git/config"] [unique_id "aiG9ky7qaeC434XaT-FqrQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
sockominfo
2026-06-03 16:00:33
(4 days ago)
Reported by TangerangKota-CSIRT. Status: MALICIOUS
Hacking
Brute-Force
🇮🇩
sockominfo
2026-06-03 15:00:25
(4 days ago)
TheHive Threat Scoring assessment: 2.56.10.36
CVSS v3.1: 0/10 (None)
CVSS Vector: CVSS:3.1/AV:undefi ...
show more
TheHive Threat Scoring assessment: 2.56.10.36
CVSS v3.1: 0/10 (None)
CVSS Vector: CVSS:3.1/AV:undefined/AC:undefined/PR:undefined/UI:undefined/S:undefined/C:undefined/I:undefined/A:undefined
Bayesian Probability: 80%
MITRE ATT&CK: Exploit Public-Facing Application, Valid Accounts, Command and Scripting Interpreter, Application Layer Protocol, Brute Force, Account Manipulation
OWASP Risk: High (L:8, I:6)
Combined Score: 4.92/10
Confidence Interval: ±0.01
Status: Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Brute-Force
🇩🇪
big-cloud.nl
2026-06-03 11:24:42
(4 days ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
Ar1s
2026-06-02 20:25:32
(5 days ago)
[1:2522000] ET TOR Known Tor Relay/Router (Not Exit) Node Traffic ::: Port: 443/TCP
Exploited Host
🇺🇸
TPI-Abuse
2026-06-02 04:05:43
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 2.56.10.36 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 2.56.10.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 00:05:27.679483 2026] [security2:error] [pid 7931:tid 7931] [client 2.56.10.36:44268] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.nutz-r-us.com"] [uri "/.git/config"] [unique_id "ah5Wh4GokUsjVRh9S5NlJgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
oncord
2026-06-01 10:48:31
(6 days ago)
Form spam
Web Spam
🇺🇸
TPI-Abuse
2026-06-01 05:15:01
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2.56.10.36 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210730) triggered by 2.56.10.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 01:14:46.026073 2026] [security2:error] [pid 30013:tid 30013] [client 2.56.10.36:60378] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||gunningphysio.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "gunningphysio.com"] [uri "/dump.sql"] [unique_id "ah0VRhlDFSpbSOZlGga11gAAABE"], referer: gunningphysio.com/dump.sql
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
avgsmoe
2026-05-31 03:41:45
(1 week ago)
CROWDSEC offender. Observed 5165 times.
Port Scan
Brute-Force
Web App Attack
🇩🇪
www.Examensfragen.de
2026-05-31 02:43:07
(1 week ago)
Open Proxy
Web Spam
Bad Web Bot
