🇸🇪
OnTheEdge
2026-09-04 12:20:45
(3 days ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇩🇪
mxbl
2026-09-04 09:00:04
(3 days ago)
Scanning for CMS vulnerabilities on a non-CMS system: /wp-sitemap.xml
Web App Attack
🇨🇿
Countryman
2026-09-04 00:10:01
(3 days ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-03 07:49:51
(4 days ago)
Unauthorized VPN login attempts: 2 attempts were recorded from 209.50.165.232
2026-09-03T09:42:49+02 ...
show more
Unauthorized VPN login attempts: 2 attempts were recorded from 209.50.165.232
2026-09-03T09:42:49+02:00 vpn Access-Reject 'aux01' station: 209.50.165.232 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-03T09:44:09+02:00 vpn Access-Reject 'wo' station: 209.50.165.232 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
lp
2026-09-02 21:21:07
(5 days ago)
Unauthorized VPN login attempts: 4 attempts were recorded from 209.50.165.232
2026-09-02T21:53:50+02 ...
show more
Unauthorized VPN login attempts: 4 attempts were recorded from 209.50.165.232
2026-09-02T21:53:50+02:00 vpn Access-Reject 'pc10' station: 209.50.165.232 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-02T21:55:16+02:00 vpn Access-Reject 'marisa' station: 209.50.165.232 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-02T21:56:39+02:00 vpn Access-Reject 'latika' station: 209.50.165.232 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-02T21:58:08+02:00 vpn Access-Reject 'grey' station: 209.50.165.232 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇳🇱
Savvii
2026-08-31 06:38:43
(1 week ago)
20 attempts against mh-misbehave-ban on grape
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
jasperedv.de
2025-12-01 10:21:38
(9 months ago)
Apache Login - Brutforcing
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 06:47:48
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.165.232 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.165.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 01:47:41.463821 2025] [security2:error] [pid 32711:tid 32711] [client 209.50.165.232:53865] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.fatello.com"] [uri "/.env"] [unique_id "aSP_jY4H7Ufq1004R3FafQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 05:13:41
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.165.232 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.165.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:12:39.082654 2025] [security2:error] [pid 10105:tid 10105] [client 209.50.165.232:31753] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.lincolnsoftwareinc.com"] [uri "/.git/HEAD"] [unique_id "aSPpR82QecIJq-12VJoaPAAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 04:56:17
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.165.232 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.165.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:56:11.362960 2025] [security2:error] [pid 3319308:tid 3319308] [client 209.50.165.232:9803] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.lucypower.com"] [uri "/.env"] [unique_id "aSPla1CRtfedAm-YLn71dwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 04:29:59
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.165.232 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.165.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:29:56.385794 2025] [security2:error] [pid 25141:tid 25141] [client 209.50.165.232:49067] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.sanjuangrange.org"] [uri "/.svn/wc.db"] [unique_id "aSPfREJc8KaKLhmG1plXaAAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-19 03:19:22
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.165.232 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.165.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 18 22:19:15.561507 2025] [security2:error] [pid 14726:tid 14726] [client 209.50.165.232:51871] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.proyectando.com"] [uri "/.env"] [unique_id "aR03M-O10GV-ZE0te8mrlgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2025-11-18 21:38:57
(9 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 23-38.209.50.165.232.web-spamm ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 23-38.209.50.165.232.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇱🇻
garmtech.com
2025-11-18 04:20:18
(9 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 06-20.209.50.165.232.web-spamm ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 06-20.209.50.165.232.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
2025-11-17 19:58:22
(9 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.17 is noted in report tim ...
show more
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.17 is noted in report timestamp
show less
Hacking
Brute-Force
