🇩🇪
LRob.fr
2026-04-06 06:00:19
(2 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-01-15 18:19:47
(4 months ago)
IM360 WAF: Old style account creation and modification in Joomla! MV:registration
Web App Attack
2025-12-22 14:50:32
(5 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇬🇧
Swiptly
2025-12-04 10:45:39
(6 months ago)
Bot scanning for environment files .env .env/\*
...
Web App Attack
🇺🇸
TPI-Abuse
2025-12-03 00:03:22
(6 months ago)
(mod_security) mod_security (id:210740) triggered by 209.50.173.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210740) triggered by 209.50.173.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 19:03:18.142535 2025] [security2:error] [pid 17672:tid 17672] [client 209.50.173.95:43013] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy||oliverhardy.com|F|4"] [data "/Proxy-Connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "oliverhardy.com"] [uri "/default.asp"] [unique_id "aS9-RoZzCRb7PAII2E9epwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 07:34:07
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.173.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.173.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:33:59.345500 2025] [security2:error] [pid 15961:tid 15961] [client 209.50.173.95:35185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.matterofbritain.com"] [uri "/.git/HEAD"] [unique_id "aSQKZxQt4EuQGuYbsIE3cgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 05:04:44
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.173.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.173.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:04:41.569386 2025] [security2:error] [pid 17163:tid 17163] [client 209.50.173.95:40677] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "abuscalledfreedom.com"] [uri "/.git/HEAD"] [unique_id "aSPnaXIgXUCcnfCWsR7rtwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 04:42:17
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.173.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.173.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:42:13.169548 2025] [security2:error] [pid 19349:tid 19349] [client 209.50.173.95:45917] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.al-harbi.com"] [uri "/.git/HEAD"] [unique_id "aSPiJdidenOrRDIc3lm6bAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 04:11:42
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.173.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.173.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:11:24.244393 2025] [security2:error] [pid 3965258:tid 3965284] [client 209.50.173.95:47343] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.deathbyaudiostore.com"] [uri "/.git/HEAD"] [unique_id "aSPa7MhgZFlRjqvFbohzUgAAAQ0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-14 05:50:57
(6 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇧🇷
hostseries
2025-10-24 23:44:43
(7 months ago)
Trigger: LF_DISTATTACK
Brute-Force
2025-10-16 14:47:09
(7 months ago)
2025-10-16T16:47:08.333542+02:00 aion wordpress[1041]: Blocked user enumeration attempt from 209.50. ...
show more
2025-10-16T16:47:08.333542+02:00 aion wordpress[1041]: Blocked user enumeration attempt from 209.50.173.95
...
show less
Hacking
Brute-Force
2025-10-16 13:28:21
(7 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
2025-10-16 08:40:15
(7 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.10.16 is noted in report tim ...
show more
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.10.16 is noted in report timestamp
show less
Hacking
Brute-Force
🇨🇦
wil.com
2025-10-15 20:01:04
(7 months ago)
GlobalProtect login attempts with user jlukas.
VPN IP
Brute-Force