🇪🇸
librebit
2026-05-17 07:02:53
(2 weeks ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-02-20 08:56:56
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 209.50.166.200 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 209.50.166.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 20 03:56:51.933694 2026] [security2:error] [pid 31188:tid 31188] [client 209.50.166.200:53669] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||moonfest.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "moonfest.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aZgh06YaXBAizGzG5WJNcAAAAA8"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
SSH-Admin
2026-02-07 17:12:28
(3 months ago)
Probing for Exploits
Exploited Host
Web App Attack
🇫🇮
Shaik Sai Meera
2025-12-30 19:30:14
(5 months ago)
IM360 WAF: Hidden file access
Brute-Force
🇺🇸
TPI-Abuse
2025-12-29 08:10:08
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.166.200 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.166.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 03:10:05.333963 2025] [security2:error] [pid 16395:tid 16395] [client 209.50.166.200:43715] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "capecodweddingideas.com"] [uri "/.env"] [unique_id "aVI3XX0AcGD7EOXRhV-8MQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 06:23:42
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.166.200 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.166.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 01:23:38.237963 2025] [security2:error] [pid 12144:tid 12144] [client 209.50.166.200:34581] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wfowisdom.com"] [uri "/.git/HEAD"] [unique_id "aVIeasbAGmMlFddRkdb5xAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
SSH-Admin
2025-12-27 13:45:08
(5 months ago)
Probing for Exploits
Exploited Host
Web App Attack
2025-12-22 14:36:40
(5 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
2025-11-27 22:34:28
(6 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.27 is noted in report tim ...
show more
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.27 is noted in report timestamp
show less
Hacking
Brute-Force
2025-11-16 22:32:03
(6 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.16 is noted in report tim ...
show more
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.16 is noted in report timestamp
show less
Hacking
Brute-Force
2025-11-11 13:22:41
(6 months ago)
Attempted brute force login to web vpn 2 time(s); last attempt for 2025.11.11 is noted in report tim ...
show more
Attempted brute force login to web vpn 2 time(s); last attempt for 2025.11.11 is noted in report timestamp
show less
Hacking
Brute-Force
2025-11-06 15:17:27
(6 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.06 is noted in report tim ...
show more
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.06 is noted in report timestamp
show less
Hacking
Brute-Force
🇨🇦
wil.com
2025-10-18 01:05:58
(7 months ago)
GlobalProtect login attempts with user quintanam.
VPN IP
Brute-Force
2025-10-13 18:17:12
(7 months ago)
Dictionary attack on Palo Alto GlobalProtect VPN portal (port 443) detected via repeated login failu ...
show more
Dictionary attack on Palo Alto GlobalProtect VPN portal (port 443) detected via repeated login failures with varying usernames.
show less
Brute-Force
🇺🇸
TPI-Abuse
2025-10-10 15:27:45
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 209.50.166.200 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 209.50.166.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 10 11:27:41.981513 2025] [security2:error] [pid 2758:tid 2758] [client 209.50.166.200:28761] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||dave-curtis.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dave-curtis.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aOkl7Rpj224T68NqKhqX5wAAAAM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack