🇨🇿
lp
2026-09-15 04:50:46
(4 days ago)
Unauthorized VPN login attempts: 9 attempts were recorded from 212.119.40.216
2026-09-15T05:52:32+02 ...
show more
Unauthorized VPN login attempts: 9 attempts were recorded from 212.119.40.216
2026-09-15T05:52:32+02:00 vpn Access-Reject 'ruby' station: 212.119.40.216 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-15T05:53:57+02:00 vpn Access-Reject 'zoeyq' station: 212.119.40.216 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-15T05:55:22+02:00 vpn Access-Reject 'mcowin' station: 212.119.40.216 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-15T05:56:48+02:00 vpn Access-Reject 'rebeccab' station: 212.119.40.216 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-15T05:58:13+02:00 vpn Access-Reject 'michaelr' station: 212.119.40.216 auth-type: - realm: vse.cz nas: <re
show less
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-09-12 00:10:01
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇱🇻
garmtech.com
2026-06-30 18:16:20
(2 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 21-16.212.119.40.216.web-spamm ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 21-16.212.119.40.216.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇱🇻
garmtech.com
2026-06-26 06:28:06
(2 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 09-28.212.119.40.216.web-spamm ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 09-28.212.119.40.216.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇬🇧
Oakley
2026-06-23 03:11:03
(2 months ago)
(mod_security) mod_security (id:900178) triggered by 212.119.40.216 (IL/Israel/-): 5 in the last 900 ...
show more
(mod_security) mod_security (id:900178) triggered by 212.119.40.216 (IL/Israel/-): 5 in the last 900 secs
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-05-21 11:06:29
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 212.119.40.216 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 212.119.40.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 07:06:24.512874 2026] [security2:error] [pid 5038:tid 5038] [client 212.119.40.216:12135] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.miroddi.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.miroddi.com"] [uri "/"] [unique_id "ag7nMJOG1UgWyalXYZJpmAAAAAk"], referer: https://www.facebook.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-07 03:03:43
(6 months ago)
(mod_security) mod_security (id:210350) triggered by 212.119.40.216 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 212.119.40.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 06 22:03:37.125933 2026] [security2:error] [pid 1619:tid 1639] [client 212.119.40.216:60667] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ceresfund.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ceresfund.com"] [uri "/"] [unique_id "aauVicRbp2ybwAuhsFC81gAAAA4"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Packets-Decreaser.NET
2025-12-10 14:34:50
(9 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
TPI-Abuse
2025-10-27 22:39:18
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 212.119.40.216 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 212.119.40.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 27 18:39:11.957875 2025] [security2:error] [pid 13961:tid 13961] [client 212.119.40.216:42465] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||staben.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "staben.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aP_0j5lCVwvVNSY3eVJA4AAAAAc"], referer: https://staben.com/wp-json/wp/v2/users/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
[email protected]
2025-10-16 00:04:42
(11 months ago)
Fail2Ban jail apache-json-scanners detected activity on 2025-10-16T00:04:42Z
Brute-Force
2025-08-14 00:43:48
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2024-12-18 07:54:39
(1 year ago)
Attempted brute force login to web vpn
Hacking
Brute-Force
2024-12-18 06:24:53
(1 year ago)
This IP was involved in an brute force and password spray attack on 2024/12/18 00:22:51
Port Scan
Brute-Force
Exploited Host
Web App Attack
2024-10-09 00:55:14
(1 year ago)
Automatic report - Vulnerability scan
/RDWeb/Pages/en-US/login.aspx
Web App Attack
2024-10-08 21:47:04
(1 year ago)
This IP was involved in an brute force and password spray attack on 2024/10/08 16:42:13
Port Scan
Brute-Force
Exploited Host
Web App Attack