2026-03-16 11:24:43
(2 months ago)
(smtpauth) Failed SMTP AUTH login from 212.56.54.38 (US/United States/-)
Brute-Force
🇺🇸
bigscoots.com
2026-02-20 12:57:05
(3 months ago)
(smtpauth) Failed SMTP AUTH login from 212.56.54.38 (US/United States/-): 5 in the last 3600 secs; P ...
show more
(smtpauth) Failed SMTP AUTH login from 212.56.54.38 (US/United States/-): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2026-02-20 07:56:33 dovecot_plain authenticator failed for H=([10.29.18.48]) [212.56.54.38]:8953: 535 Incorrect authentication data ([email protected] )
2026-02-20 07:56:39 dovecot_login authenticator failed for H=([10.29.18.48]) [212.56.54.38]:8953: 535 Incorrect authentication data ([email protected] )
2026-02-20 07:56:45 dovecot_plain authenticator failed for H=([10.29.18.48]) [212.56.54.38]:10988: 535 Incorrect authentication data ([email protected] )
2026-02-20 07:56:51 dovecot_login authenticator failed for H=([10.29.18.48]) [212.56.54.38]:10988: 535 Incorrect authentication data ([email protected] )
2026-02-20 07:57:03 dovecot_plain authenticator failed for H=([10.29.18.48]) [212.56.54.38]:41018: 535 Incorrect authentication data ([email protected] )
show less
Brute-Force
SSH
🇨🇿
lp
2026-02-20 09:10:51
(3 months ago)
Email account brute force: 6 attempts were recorded from 212.56.54.38
2026-02-20T09:57:23+01:00 warn ...
show more
Email account brute force: 6 attempts were recorded from 212.56.54.38
2026-02-20T09:57:23+01:00 warning: unknown[212.56.54.38]: SASL PLAIN authentication failed: authentication failure, [email protected]
2026-02-20T09:57:24+01:00 warning: unknown[212.56.54.38]: SASL LOGIN authentication failed: authentication failure, [email protected]
2026-02-20T09:57:25+01:00 warning: unknown[212.56.54.38]: SASL PLAIN authentication failed: authentication failure, [email protected]
2026-02-20T09:57:25+01:00 warning: unknown[212.56.54.38]: SASL LOGIN authentication failed: authentication failure, [email protected]
2026-02-20T09:57:32+01:00 warning: unknown[212.56.54.38]: SASL PLAIN authentication failed: authentication failure, [email protected]
2026-02-20T09:57:33+01:00 warning: unknown[212.56.54.38]: SASL LOGIN authentication failed: authentication fai
show less
Brute-Force
🇺🇸
xmission.com
2026-01-10 14:24:08
(5 months ago)
Blocked by UFW (TCP on 1)
Source port: 51620
TTL: 113
Packet length: 52
TOS: 0x08
This report (for ...
show more
Blocked by UFW (TCP on 1)
Source port: 51620
TTL: 113
Packet length: 52
TOS: 0x08
This report (for 212.56.54.38) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇺🇸
webgobe
2025-08-15 21:57:22
(9 months ago)
wew-Joomla User : try to access forms...
Hacking
🇺🇸
TPI-Abuse
2025-08-05 00:50:37
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 212.56.54.38 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 212.56.54.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 04 20:50:33.358958 2025] [security2:error] [pid 19718:tid 19718] [client 212.56.54.38:53531] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||customhumanrobots.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "customhumanrobots.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aJFVWYrln2fX0Ngp8T3MgAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-04 16:32:35
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 212.56.54.38 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 212.56.54.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 04 12:32:31.440977 2025] [security2:error] [pid 32765:tid 32765] [client 212.56.54.38:64941] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ashleycroft.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ashleycroft.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aJDgny4SHiU64A4lT0-MJQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
peterh
2025-07-10 10:48:00
(11 months ago)
212.56.54.38 - - [10/Jul/2025:12:40:34 +0200] "SSH-2.0-WanScannerBot" 400 226 "-" "-"
212.56.54.38 ...
show more
212.56.54.38 - - [10/Jul/2025:12:40:34 +0200] "SSH-2.0-WanScannerBot" 400 226 "-" "-"
212.56.54.38 - - [10/Jul/2025:12:40:35 +0200] "\x03" 400 226 "-" "-"
212.56.54.38 - - [10/Jul/2025:12:40:36 +0200] "\x10\x0f" 400 226 "-" "-"
212.56.54.38 - - [10/Jul/2025:12:40:45 +0200] "OPTIONS / RTSP/1.0" 400 226 "-" "-"
show less
Phishing
VPN IP
Hacking
Bad Web Bot
Web App Attack
🇦🇱
router.al
2025-06-16 14:47:21
(11 months ago)
06/16/2025-14:47:21.532236 212.56.54.38 Protocol: 6 SURICATA SMTP invalid reply
Hacking