216.26.229.30

[19:33] Attempted HTTPS GlobalProtect login with credentials bennett:Pa*****d1

[15:58] Attempted HTTPS GlobalProtect login with credentials devvolunteer:de********er

[23:23] Attempted HTTPS GlobalProtect login with credentials fcollins:Pa*****d1

repeated unauthorized VPN login attempt, user sweep

Wordfence waf block on uvfousor WPIDD

[ssd5.kdns.gr] httpd-login-spray-site: sites=www.cancelletto.gr; logs=/var/log/httpd/domains/cancelletto.gr.log; samples=site_wide=true | distinct_ips=50 | /wp-login.php

SMS pumping

Wordpress malicious attack:[octawp]

(mod_security) mod_security (id:210492) triggered by 216.26.229.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 05:22:31.465901 2025] [security2:error] [pid 22485:tid 22485] [client 216.26.229.30:44329] M ... show more (mod_security) mod_security (id:210492) triggered by 216.26.229.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 05:22:31.465901 2025] [security2:error] [pid 22485:tid 22485] [client 216.26.229.30:44329] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.jimmyshakes.org"] [uri "/.svn/wc.db"] [unique_id "aSbU5-zwfwxigsf1O-5FWAAAAAw"] show less

(mod_security) mod_security (id:210492) triggered by 216.26.229.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 02:13:20.891617 2025] [security2:error] [pid 14889:tid 14889] [client 216.26.229.30:56167] M ... show more (mod_security) mod_security (id:210492) triggered by 216.26.229.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 02:13:20.891617 2025] [security2:error] [pid 14889:tid 14889] [client 216.26.229.30:56167] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.linearconceptsllc.com"] [uri "/.svn/wc.db"] [unique_id "aSaokHyPKzH9QHaZmJOpngAAAAY"] show less

(mod_security) mod_security (id:210492) triggered by 216.26.229.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 20:01:57.981812 2025] [security2:error] [pid 3365545:tid 3365686] [client 216.26.229.30:9723 ... show more (mod_security) mod_security (id:210492) triggered by 216.26.229.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 20:01:57.981812 2025] [security2:error] [pid 3365545:tid 3365686] [client 216.26.229.30:9723] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rush.piazzala.com"] [uri "/.env"] [unique_id "aSZRhSa0-q0nx5VbsSBiAQAAAko"] show less

(mod_security) mod_security (id:210492) triggered by 216.26.229.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 19:56:14.897535 2025] [security2:error] [pid 30228:tid 30228] [client 216.26.229.30:37127] M ... show more (mod_security) mod_security (id:210492) triggered by 216.26.229.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 19:56:14.897535 2025] [security2:error] [pid 30228:tid 30228] [client 216.26.229.30:37127] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.theantidote.agency.gregorii.com"] [uri "/.git/HEAD"] [unique_id "aST-rkomR53ZXlsqu8lFWgAAAAk"] show less

(mod_security) mod_security (id:210492) triggered by 216.26.229.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:00:13.131475 2025] [security2:error] [pid 570:tid 570] [client 216.26.229.30:55007] ModSe ... show more (mod_security) mod_security (id:210492) triggered by 216.26.229.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:00:13.131475 2025] [security2:error] [pid 570:tid 570] [client 216.26.229.30:55007] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.26c.org"] [uri "/.svn/wc.db"] [unique_id "aSPmXbPNU4kNLJjADozDSQAAAAk"] show less

This IP was involved in a brute force and password spray attack.

GlobalProtect login attempts with user brianhill.