|
🇦🇺
2000cn.com.au
|
|
This IP was detected by CrowdSec triggering crowdsecurity/CVE-2017-9841
|
Web App Attack
|
|
|
🇮🇹
VHosting
|
|
Detected attack by Imunify360
|
Brute-Force
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:243930) triggered by 23.95.61.57 (23-95-61-57-host.colocrossing.com) ...
show more
(mod_security) mod_security (id:243930) triggered by 23.95.61.57 (23-95-61-57-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 25 22:41:11.878859 2025] [security2:error] [pid 571:tid 571] [client 23.95.61.57:48404] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?:\\\\w+\\\\/[\\\\w\\\\-\\\\.]+)(?:;(?:charset=[\\\\w\\\\-]{1,18}|boundary=[\\\\w\\\\-]+)?)?$" against "REQUEST_HEADERS:Content-Type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6743"] [id "243930"] [rev "2"] [msg "COMODO WAF: Remote code execution in Apache Struts versions 2.3.31 - 2.3.5 and 2.5 - 2.5.10 (CVE-2017-5638)||www.tttns.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.tttns.com"] [uri "/"] [unique_id "aK0ex7WC5sSx1Fsswtgs5wAAAAg"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇫🇷
dynamix
|
|
Multiple WAF Violations
|
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:243930) triggered by 23.95.61.57 (23-95-61-57-host.colocrossing.com) ...
show more
(mod_security) mod_security (id:243930) triggered by 23.95.61.57 (23-95-61-57-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 14 03:08:37.187284 2025] [security2:error] [pid 15788:tid 15788] [client 23.95.61.57:52564] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?:\\\\w+\\\\/[\\\\w\\\\-\\\\.]+)(?:;(?:charset=[\\\\w\\\\-]{1,18}|boundary=[\\\\w\\\\-]+)?)?$" against "REQUEST_HEADERS:Content-Type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6743"] [id "243930"] [rev "2"] [msg "COMODO WAF: Remote code execution in Apache Struts versions 2.3.31 - 2.3.5 and 2.5 - 2.5.10 (CVE-2017-5638)||www.itony.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.itony.com"] [uri "/"] [unique_id "aJ2Lda3Cr0QggV1uASh4dgAAAA0"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:243930) triggered by 23.95.61.57 (23-95-61-57-host.colocrossing.com) ...
show more
(mod_security) mod_security (id:243930) triggered by 23.95.61.57 (23-95-61-57-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 13 23:36:24.219242 2025] [security2:error] [pid 19107:tid 19107] [client 23.95.61.57:51460] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?:\\\\w+\\\\/[\\\\w\\\\-\\\\.]+)(?:;(?:charset=[\\\\w\\\\-]{1,18}|boundary=[\\\\w\\\\-]+)?)?$" against "REQUEST_HEADERS:Content-Type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6743"] [id "243930"] [rev "2"] [msg "COMODO WAF: Remote code execution in Apache Struts versions 2.3.31 - 2.3.5 and 2.5 - 2.5.10 (CVE-2017-5638)||www.hwh17.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.hwh17.com"] [uri "/"] [unique_id "aJ1ZuOYDxIklAW-qiM9WbgAAAAw"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
Anonymous
|
|
sql injection
|
Web App Attack
|
|
|
🇺🇸
antbr.com
|
|
AntBR.com: [Repeated Attack]==> /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
|
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 23.95.61.57 (23-95-61-57-host.colocrossing.com) ...
show more
(mod_security) mod_security (id:210492) triggered by 23.95.61.57 (23-95-61-57-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 28 21:03:51.805452 2025] [security2:error] [pid 7887:tid 7887] [client 23.95.61.57:32918] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.old" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.ibasv.com"] [uri "/wp-config.old"] [unique_id "aGCQ94G5jM59-c1HdT9--AAAAAg"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇮🇹
VHosting
|
|
Detected attack by Imunify360
|
Brute-Force
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 23.95.61.57 (23-95-61-57-host.colocrossing.com) ...
show more
(mod_security) mod_security (id:210492) triggered by 23.95.61.57 (23-95-61-57-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 28 03:16:49.588922 2025] [security2:error] [pid 3493680:tid 3493723] [client 23.95.61.57:42772] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.emmyc.com"] [uri "/.wp-config.php.swp"] [unique_id "aF-W4bdfciLCzN-T5QFfAAAAAEk"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
Anonymous
|
|
Multiple web server 400 error codes from same source ip
|
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 23.95.61.57 (23-95-61-57-host.colocrossing.com) ...
show more
(mod_security) mod_security (id:210492) triggered by 23.95.61.57 (23-95-61-57-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 27 10:02:22.725225 2025] [security2:error] [pid 845514:tid 845514] [client 23.95.61.57:36496] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.biff0.com"] [uri "/wp-config.php.orig"] [unique_id "aF6kbu159C7sYmLD3jZTPgAAAAk"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇦🇷
dblanque
|
|
Fail2ban - SSHD Ban Event Triggered. (IP: 23.95.61.57)
|
SSH
|
|
|
🇺🇸
yzfdude1
|
|
Jul 7 02:04:12 b146-53 sshd[1857317]: Failed password for root from 23.95.61.57 port 46174 ssh2
Jul ...
show more
Jul 7 02:04:12 b146-53 sshd[1857317]: Failed password for root from 23.95.61.57 port 46174 ssh2
Jul 7 02:04:21 b146-53 sshd[1857328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.61.57 user=root
Jul 7 02:04:23 b146-53 sshd[1857328]: Failed password for root from 23.95.61.57 port 47940 ssh2
...
show less
|
Brute-Force
SSH
|
|