🇨🇭
Origon
2026-08-06 15:29:36
UTC ·
(3 months ago)
NOQUEUE - IP: 41.142.65.241 - Aug 6 17:29:36 plesk postfix/smtpd[2027544]: NOQUEUE: reject: RCPT from unknown[41.142.65.241]: 554 5.7.1 Service unavailable; Client host [41.142.65.241] blocked using dnsbl-1.uceprotect.net; IP 41.142.65.241 is UCEPRO ...
show more
NOQUEUE - IP: 41.142.65.241 - Aug 6 17:29:36 plesk postfix/smtpd[2027544]: NOQUEUE: reject: RCPT from unknown[41.142.65.241]: 554 5.7.1 Service unavailable; Client host [41.142.65.241] blocked using dnsbl-1.uceprotect.net; IP 41.142.65.241 is UCEPROTECT-Level 1 listed. See http://www.uceprotect.net/rblcheck.php?ipr=41.142.65.241; from=<REDACTED@REDACTED> to=<REDACTED@REDACTED> proto=ESMTP helo=<[41.142.65.241]>
show less
Email Spam
🇩🇰
powerhostingdk
2026-08-06 10:48:09
UTC ·
(3 months ago)
[mailserver] CrowdSec detected crowdsecurity/postscreen-rbl (1 events). Automated abuse report.
Email Spam
Brute-Force
🇦🇺
screwlooseit.com.au
2026-07-26 12:03:59
UTC ·
(3 months ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
MA/Morocco/-
Web App Attack
🇮🇳
evicky2002
2026-05-01 06:17:05
UTC ·
(6 months ago)
Confirmed malicious by STILWaters CTI platform (score=91, sources=1)
Hacking
Brute-Force
SSH
🇬🇧
openstrike.co.uk
2026-04-12 05:16:13
UTC ·
(7 months ago)
50 attacks on env grabbing URLs, PHP URLs, password grabbing URLs, VC URLs:
GET /.env.local HTTP/1.1
GET /info.php HTTP/1.1
GET //config/.aws/credentials HTTP/1.1
GET /admin/.git/config HTTP/1.1
Hacking
Web App Attack
🇺🇸
NicoID
2026-04-12 00:05:18
UTC ·
(7 months ago)
41.142.65.241 - - [11/Apr/2026:03:25:37 -0600] "GET /wp-login.php HTTP/2.0" 200 3232 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"
...
Brute-Force
🇩🇪
tinect
2026-04-11 20:20:24
UTC ·
(7 months ago)
This IP was detected by CrowdSec triggering tinect/http-sensitive-file-probe
Web App Attack
🇩🇪
dbmwebdesign
2026-04-11 19:15:11
UTC ·
(7 months ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇺🇸
TPI-Abuse
2026-04-11 19:12:02
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 41.142.65.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 15:11:57.671553 2026] [security2:error] [pid 3197860:tid 3197860] [client 41.142.65.241:6001 ...
show more
(mod_security) mod_security (id:210492) triggered by 41.142.65.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 15:11:57.671553 2026] [security2:error] [pid 3197860:tid 3197860] [client 41.142.65.241:60011] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.legendesignhouse.com"] [uri "/.env"] [unique_id "adqc_Vshuxk1rU3uOHooegAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
seniorlinuxadmin
2026-04-11 18:56:03
UTC ·
(7 months ago)
41.142.65.241 - - [11/Apr/2026:19:56:00 +0100] "GET /_profiler/phpinfo.php HTTP/1.1" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-04-11 16:18:33
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 41.142.65.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 12:18:30.543296 2026] [security2:error] [pid 813938:tid 813938] [client 41.142.65.241:50266] ...
show more
(mod_security) mod_security (id:210492) triggered by 41.142.65.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 12:18:30.543296 2026] [security2:error] [pid 813938:tid 813938] [client 41.142.65.241:50266] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.auditleverage.com"] [uri "/.env"] [unique_id "adp0VkDmDBwyf8VicndSaQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Matthew Ping
2026-04-11 16:15:01
UTC ·
(7 months ago)
ModSecurity rule 949110 triggered on wp3. Web application attack blocked by CSF/LFD.
Web App Attack
Hacking
🇺🇸
mind5t0rm
2026-04-11 16:08:22
UTC ·
(7 months ago)
(WPLOGIN) WP Login Attack 41.142.65.241 (MA/Morocco/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 41.142.65.241 - - [11/Apr/2026:23:08:13 +0700] "GET /wp-login.php HTTP/2.0" 200 2684 "-" "Mozilla/5.0 (Windows NT ...
show more
(WPLOGIN) WP Login Attack 41.142.65.241 (MA/Morocco/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 41.142.65.241 - - [11/Apr/2026:23:08:13 +0700] "GET /wp-login.php HTTP/2.0" 200 2684 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"
41.142.65.241 - - [11/Apr/2026:23:08:17 +0700] "POST /wp-login.php HTTP/2.0" 200 2836 "https://greekthai.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
41.142.65.241 - - [11/Apr/2026:23:08:21 +0700] "POST /wp-login.php HTTP/2.0" 200 2836 "https://greekthai.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-04-11 16:00:48
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 41.142.65.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 12:00:42.010674 2026] [security2:error] [pid 374104:tid 374104] [client 41.142.65.241:55283] ...
show more
(mod_security) mod_security (id:210492) triggered by 41.142.65.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 12:00:42.010674 2026] [security2:error] [pid 374104:tid 374104] [client 41.142.65.241:55283] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fishing-links.com"] [uri "/.env"] [unique_id "adpwKrxHHeMzWQHOtZyh4wAAACw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
masterguru
2026-04-11 15:45:29
UTC ·
(7 months ago)
WordPress: User enumeration. Pattern match "(author\\\\= (88030-169)
Hacking