|
🇿🇦
maximonline.co.za
|
|
Brute Force SMTP AUTH Attack
|
Brute-Force
|
|
|
🇷🇺
webserfer
|
|
[f2b] honeypot [W1:1:?]
|
Port Scan
Hacking
|
|
|
🇺🇦
TawnyBalfour
|
|
MSSQL honeypot. Target port: 1433. Window: 2026-09-18 08:03 to 2026-09-18 08:03 UTC.
|
Port Scan
|
|
|
🇮🇩
xveil
|
|
2026-08-26T00:43:49.604487 mail-honeypot postfix/submission/smtpd[28591]: warning: unknown[5.253.206 ...
show more
2026-08-26T00:43:49.604487 mail-honeypot postfix/submission/smtpd[28591]: warning: unknown[5.253.206.35]: SASL LOGIN authentication failed: authentication failure
...
show less
|
Brute-Force
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:240335) triggered by 5.253.206.35 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 5.253.206.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 09:08:47.811254 2026] [security2:error] [pid 2713:tid 2713] [client 5.253.206.35:58107] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 5.253.206.35 (+1 hits since last alert)|thesalonx.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thesalonx.com"] [uri "/xmlrpc.php"] [unique_id "aj55367EPMRuFrCnVooE_QAAABk"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 5.253.206.35 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 5.253.206.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 19 13:34:28.644273 2026] [security2:error] [pid 7992:tid 7992] [client 5.253.206.35:59256] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hecticred.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hecticred.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aW55NER8pvsdPYl7wsPF3QAAAAE"], referer: https://www.google.com
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 5.253.206.35 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 5.253.206.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 15 11:41:05.213625 2026] [security2:error] [pid 9510:tid 9510] [client 5.253.206.35:44352] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||josephshv.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "josephshv.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aWkYoYx7wwyKbMUSjemCBwAAAAo"], referer: https://www.google.com
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇩🇪
F242
|
|
Wordpress Login or XMLRPC abuse
|
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 5.253.206.35 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 5.253.206.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 19:06:05.195771 2026] [security2:error] [pid 30562:tid 30562] [client 5.253.206.35:56730] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||liquid-libido.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "liquid-libido.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aVsAbWzH5KbAJH42AWWVhQAAAAI"], referer: https://www.google.com
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇯🇵
VXG-NET
|
|
port=80, indicator_type=info-leak
|
Hacking
|
|
|
🇺🇸
juguemosalacarioca.com
|
|
Multiple HTTP calls attempting to GET resources using common API calls or formats on port 8080
|
Web App Attack
|
|
|
🇯🇵
VXG-NET
|
|
port=80, indicator_type=info-leak
|
Hacking
|
|
|
🇧🇷
vfAcceloReporter
|
|
5.253.206.35 - - [04/Sep/2025:14:17:25 -0300] "GET /.env HTTP/1.1" 404 125 "-" "Mozilla/5.0 (Macinto ...
show more
5.253.206.35 - - [04/Sep/2025:14:17:25 -0300] "GET /.env HTTP/1.1" 404 125 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
...
show less
|
Brute-Force
Exploited Host
Web App Attack
|
|
|
Anonymous
|
|
suspicious request in access.log
|
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 5.253.206.35 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 5.253.206.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 17 05:40:41.081935 2025] [security2:error] [pid 10510:tid 10510] [client 5.253.206.35:57726] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cs-mall.com"] [uri "/.env"] [unique_id "aHjFGTekfeZfi3663_DKNAAAAAA"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|