🇮🇹
VHosting
2026-02-19 02:56:37
(4 months ago)
Detected mail brute force attack from 4 different servers
Brute-Force
🇨🇦
Mediashaker
2026-02-19 02:55:18
(4 months ago)
(smtpauth) Failed SMTP AUTH login from 212.56.54.98 (US/United States/-)
Brute-Force
🇺🇸
bigscoots.com
2026-02-19 02:44:35
(4 months ago)
(smtpauth) Failed SMTP AUTH login from 212.56.54.98 (US/United States/-): 5 in the last 3600 secs; P ...
show more
(smtpauth) Failed SMTP AUTH login from 212.56.54.98 (US/United States/-): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2026-02-18 21:44:05 dovecot_plain authenticator failed for H=([10.9.18.132]) [212.56.54.98]:13640: 535 Incorrect authentication data ([email protected] )
2026-02-18 21:44:11 dovecot_login authenticator failed for H=([10.9.18.132]) [212.56.54.98]:13640: 535 Incorrect authentication data ([email protected] )
2026-02-18 21:44:17 dovecot_plain authenticator failed for H=([10.9.18.132]) [212.56.54.98]:59439: 535 Incorrect authentication data ([email protected] )
2026-02-18 21:44:23 dovecot_login authenticator failed for H=([10.9.18.132]) [212.56.54.98]:59439: 535 Incorrect authentication data ([email protected] )
2026-02-18 21:44:31 dovecot_plain authenticator failed for H=([10.9.18.132]) [212.56.54.98]:1099: 535 Incorrect authentication data ([email protected] )
show less
Brute-Force
SSH
🇨🇭
Origon
2026-02-19 02:44:22
(4 months ago)
postfix-spam - IP: 212.56.54.98 - time="2026-02-19T03:44:22+01:00" level=info msg="(555f66b4f6a7455 ...
show more
postfix-spam - IP: 212.56.54.98 - time="2026-02-19T03:44:22+01:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/postfix-spam by ip 212.56.54.98 (US/4213) : 4h ban on Ip 212.56.54.98" module=db
show less
Email Spam
🇺🇸
TPI-Abuse
2026-01-29 13:17:01
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 212.56.54.98 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 212.56.54.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 08:16:54.173073 2026] [security2:error] [pid 27365:tid 27365] [client 212.56.54.98:46614] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||miszewski.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "miszewski.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXtdxsvaUVHz88tVXpKPiAAAAA8"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-29 11:19:53
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 212.56.54.98 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 212.56.54.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 06:19:46.695243 2026] [security2:error] [pid 17319:tid 17319] [client 212.56.54.98:42258] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||andrsn.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "andrsn.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXtCUrwyDYcmE5X0kFkHAwAAAAs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
b4un0
2026-01-10 02:07:52
(5 months ago)
Auto-report from pfSense: Detected suspicious activity.
Brute-Force
SSH
🇵🇱
b4un0
2026-01-09 00:16:45
(5 months ago)
Auto-report from pfSense: Detected suspicious activity.
Brute-Force
SSH
🇵🇱
b4un0
2026-01-07 21:10:28
(5 months ago)
Auto-report from pfSense: Detected suspicious activity.
Brute-Force
SSH
🇳🇱
Savvii
2025-12-18 11:13:00
(6 months ago)
21 attempts against mh_ha-misbehave-ban on star
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2025-12-18 03:09:43
(6 months ago)
Detected mail brute force attack from 4 different servers
Brute-Force
🇺🇸
bigscoots.com
2025-12-18 03:08:27
(6 months ago)
(smtpauth) Failed SMTP AUTH login from 212.56.54.98 (US/United States/-): 5 in the last 3600 secs; P ...
show more
(smtpauth) Failed SMTP AUTH login from 212.56.54.98 (US/United States/-): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2025-12-17 22:05:47 dovecot_login authenticator failed for (ADMIN) [212.56.54.98]:37154: 535 Incorrect authentication data ([email protected] )
2025-12-17 22:07:34 dovecot_login authenticator failed for (ADMIN) [212.56.54.98]:6986: 535 Incorrect authentication data ([email protected] )
2025-12-17 22:08:02 dovecot_login authenticator failed for (ADMIN) [212.56.54.98]:35876: 535 Incorrect authentication data ([email protected] )
2025-12-17 22:08:09 dovecot_login authenticator failed for (ADMIN) [212.56.54.98]:19127: 535 Incorrect authentication data ([email protected] )
2025-12-17 22:08:24 dovecot_login authenticator failed for (ADMIN) [212.56.54.98]:52993: 535 Incorrect authentication data ([email protected] )
show less
Brute-Force
SSH
🇺🇸
xmission.com
2025-11-10 19:34:32
(7 months ago)
Blocked by UFW (TCP on 62121)
Source port: 4670
TTL: 110
Packet length: 52
TOS: 0x08
This report (f ...
show more
Blocked by UFW (TCP on 62121)
Source port: 4670
TTL: 110
Packet length: 52
TOS: 0x08
This report (for 212.56.54.98) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇺🇸
mnsf
2025-07-21 10:05:21
(10 months ago)
Too many Status 40X (20)
Brute-Force
Web App Attack
🇩🇪
marzzzello
2025-05-26 02:50:32
(1 year ago)
Ports: 2x 2978
Port Scan