🇺🇸
Peter Racine
2026-07-13 12:15:00
(1 day ago)
Credential stuffing - exchange accounts
Brute-Force
🇫🇷
Sklurk
2026-07-08 01:36:11
(1 week ago)
Web App Attack
Web App Attack
🇫🇷
LRob
2026-06-06 14:00:06
(1 month ago)
Repeated 403 errors, blocked by Fail2ban in custom-403 jail
Bad Web Bot
🇪🇸
10dencehispahard SL
2025-12-29 11:00:47
(6 months ago)
Wordpress probing for vulnerabilities
Hacking
Exploited Host
2025-12-11 23:33:39
(7 months ago)
[12/Dec/2025:10:33:38 +1100] "GET /wp-login.php HTTP/1.1" 403 239 "Mozilla/5.0 (Windows NT 10.0; Win ...
show more
[12/Dec/2025:10:33:38 +1100] "GET /wp-login.php HTTP/1.1" 403 239 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203"
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 06:23:30
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.235.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.235.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 01:23:23.096427 2025] [security2:error] [pid 15673:tid 15673] [client 216.26.235.9:50767] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.starfi.com"] [uri "/.git/HEAD"] [unique_id "aSVLW05xUfQih8uWnGUV5wAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 04:25:11
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.235.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.235.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:25:06.194559 2025] [security2:error] [pid 22489:tid 22489] [client 216.26.235.9:21871] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.paxbrewing.com"] [uri "/.env"] [unique_id "aSUvoq9P57JdwHdxHZ1BRAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 03:57:22
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.235.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.235.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:57:17.344826 2025] [security2:error] [pid 32041:tid 32041] [client 216.26.235.9:15471] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.sebog.org"] [uri "/.git/HEAD"] [unique_id "aSUpHSYER2CowlihRyxZBQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 02:49:15
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.235.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.235.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:49:04.700402 2025] [security2:error] [pid 5899:tid 5899] [client 216.26.235.9:56543] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.robyndesigns.com"] [uri "/.git/HEAD"] [unique_id "aSUZILT9viiFWai2zBFmagAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 00:23:27
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.235.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.235.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 19:23:21.873457 2025] [security2:error] [pid 1590769:tid 1590781] [client 216.26.235.9:56331] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "anp-designs.sea2er.com"] [uri "/.svn/wc.db"] [unique_id "aST2-WGwGZE4_DDLbJbW_AAAAIo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-02 16:13:00
(8 months ago)
This IP was involved in an brute force and password spray attack on 2025/11/02 06:55:41
Port Scan
Brute-Force
Exploited Host
Web App Attack
2025-10-29 05:04:22
(8 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇨🇦
wil.com
2025-10-17 17:40:28
(8 months ago)
GlobalProtect login attempts with user msapp.
VPN IP
Brute-Force
🇧🇷
hostseries
2025-10-13 12:02:03
(9 months ago)
Trigger: LF_DISTATTACK
Brute-Force
2025-10-07 02:43:21
(9 months ago)
Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.07 is noted in report tim ...
show more
Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.07 is noted in report timestamp
show less
Hacking
Brute-Force