Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
(mod_security) mod_security (id:225080) triggered by 38.250.149.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 12:18:11.583043 2026] [security2:error] [pid 12069:tid 12069] [client 38.250.149.52:32201] M ...
show more(mod_security) mod_security (id:225080) triggered by 38.250.149.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 12:18:11.583043 2026] [security2:error] [pid 12069:tid 12069] [client 38.250.149.52:32201] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^[\\\\d\\\\.ab]+$" against "ARGS_GET:C" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "143"] [id "225080"] [rev "1"] [msg "COMODO WAF: XSS vulnerability in Plupload before 2.1.9 or MediaElement.js before 2.21.0, as used in WordPress before 4.5.2 (CVE-2016-4566 & CVE-2016-4567)||daveware.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "daveware.net"] [uri "/wp-includes/js/tinymce/themes/advanced/skins/default/"] [unique_id "avSjU0W_P6IBniad2K0F3wAAAB8"], referer: https://daveware.net/
show less
CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1763506800/cat_ids~828,144,143/tag_ids~536,452,476,757,323,725/request_format~json/ | UA: ...
show moreCrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1763506800/cat_ids~828,144,143/tag_ids~536,452,476,757,323,725/request_format~json/ | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
show less
DDoS Attack
Web App Attack
Anonymous
Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (Explicitly identified himself as enemy a week before attack began) | Aggressive search filter manipulation / web scraper probe on port 443 | URI: Exces ...
show moreAttribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (Explicitly identified himself as enemy a week before attack began) | Aggressive search filter manipulation / web scraper probe on port 443 | URI: Excessive filters used: /catalogsearch/result/?product_vc_type=100%2C103&q=ex+90&screensize=18%2C22%2C23 | UA: Mozilla/5.0 (Windows; U; Windows NT 6.0) AppleWebKit/535.5.2 (KHTML, like Gecko) Version/5.0.4 Safari/535.5.2 | (Magento Site)
show less
(smtpauth) Failed SMTP AUTH login from 38.250.149.52 (PE/Peru/-): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2026-05-22 13:11:10 SMTP call from [38.250.149.52]:53005 dropped: too many syntax or protocol erro ...
show more(smtpauth) Failed SMTP AUTH login from 38.250.149.52 (PE/Peru/-): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2026-05-22 13:11:10 SMTP call from [38.250.149.52]:53005 dropped: too many syntax or protocol errors (last command was "?\034?\032?\027?\031?\034?\033?\030?\032?\026?\016?\r?\v?\f?\t?", NULL)
2026-05-22 13:14:43 dovecot_plain authenticator failed for H=(DESKTOP-OERUNNA) [38.250.149.52]:55651: 535 Incorrect authentication data ([email protected])
2026-05-22 13:14:54 dovecot_plain authenticator failed for H=(DESKTOP-OERUNNA) [38.250.149.52]:55661: 535 Incorrect authentication data (set_id=xxxxxxx4970)
2026-05-22 13:15:09 SMTP call from [38.250.149.52]:55703 dropped: too many syntax or protocol errors (last command was "?\034?\032?\027?\031?\034?\033?\030?\032?\026?\016?\r?\v?\f?\t?", NULL)
2026-05-22 13:15:12 dovecot_plain authenticator failed for H=(DESKTOP-OERUNNA) [38.250.149.52]:55680: 535 Incorrect authentication data
show less
