🇭🇺
bcsaba
2025-09-29 06:04:52
(9 months ago)
CMS (WordPress or Joomla) login attempt.
203.159.81.53 - - [29/Sep/2025:08:02:55 +0200] "POST /wp-lo ...
show more
CMS (WordPress or Joomla) login attempt.
203.159.81.53 - - [29/Sep/2025:08:02:55 +0200] "POST /wp-login.php HTTP/1.1" 200 11082 "https://www.*REDACTED*/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"
show less
Hacking
Brute-Force
Web App Attack
🇧🇪
cmbplf
2025-09-29 02:21:13
(9 months ago)
1.000 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2025-09-28 01:57:22
(9 months ago)
(mod_security) mod_security (id:210801) triggered by 203.159.81.53 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210801) triggered by 203.159.81.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 27 21:56:48.623166 2025] [security2:error] [pid 31375:tid 31375] [client 203.159.81.53:23205] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "sqlmap" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||clubfansite.com|F|2"] [data "sqlmap/1.9.9.1#dev (https://sqlmap.org)"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "clubfansite.com"] [uri "/rro.php"] [unique_id "aNiV4KCy6lQBXprwKRjIMwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
exxos
2025-09-27 23:05:45
(9 months ago)
Attacks with Bad user agents
Hacking
🇺🇸
TPI-Abuse
2025-09-20 02:56:04
(9 months ago)
(mod_security) mod_security (id:210801) triggered by 203.159.81.53 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210801) triggered by 203.159.81.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 19 22:55:43.105060 2025] [security2:error] [pid 9456:tid 9456] [client 203.159.81.53:35521] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "sqlmap" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||thegamblefamily.com|F|2"] [data "sqlmap/1.9.9.1#dev (https://sqlmap.org)"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "thegamblefamily.com"] [uri "/"] [unique_id "aM4Xr1Ct2oCejw40SEEOcAAAACk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-16 16:22:52
(10 months ago)
(mod_security) mod_security (id:210801) triggered by 203.159.81.53 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210801) triggered by 203.159.81.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 16 12:22:46.983392 2025] [security2:error] [pid 15104:tid 15104] [client 203.159.81.53:34961] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "sqlmap" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||fydelitybags.com|F|2"] [data "sqlmap/1.9.9.1#dev (https://sqlmap.org)"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "fydelitybags.com"] [uri "/"] [unique_id "aMmO1hsK4MBD-88aHfYjuAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇸
Smel
2025-09-01 08:23:15
(10 months ago)
SQL/MH Probe, Scan, Hack -
Port Scan
Hacking
SQL Injection
🇳🇱
EGP Abuse Dept
2025-09-01 06:33:46
(10 months ago)
Unauthorized connection to MySQL port 3306
Port Scan
Hacking
🇺🇸
xmission.com
2025-09-01 00:39:44
(10 months ago)
Blocked by UFW (TCP on 3306)
Source port: 27259
TTL: 42
Packet length: 60
TOS: 0x08
This report (fo ...
show more
Blocked by UFW (TCP on 3306)
Source port: 27259
TTL: 42
Packet length: 60
TOS: 0x08
This report (for 203.159.81.53) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
SQL Injection
🇺🇸
RAP
2025-08-30 16:03:57
(10 months ago)
2025-08-30 16:03:57 UTC Unauthorized activity to TCP port 23. Telnet
Port Scan
2025-08-30 04:43:56
(10 months ago)
Port Scanner
Port Scan
🇫🇷
pm33
2025-08-29 04:46:58
(10 months ago)
Probing for resource vulnerabilities HTTP(S)
Web App Attack
🇺🇸
MPL
2025-08-25 07:22:50
(10 months ago)
tcp/3306 (6 or more attempts)
Port Scan
🇩🇪
neckaralb-admin.de
2025-08-14 16:41:15
(11 months ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
VMHeaven.io
2025-07-21 03:56:18
(11 months ago)
Blocked by UFW [37215/tcp]
Source port: 34791
TTL: 45
Packet length: 60
Port Scan