🇸🇮
administrator
2026-10-09 22:06:10
(16 hours ago)
2026-10-08 10:00:58,732 fail2ban.actions [2774549]: NOTICE [error-bots] Ban 65.111.10.2
2026 ...
show more
2026-10-08 10:00:58,732 fail2ban.actions [2774549]: NOTICE [error-bots] Ban 65.111.10.2
2026-10-08 10:00:58,732 fail2ban.actions [2774549]: NOTICE [error-bots] Ban 65.111.10.2
2026-10-08 10:00:58,732 fail2ban.actions [2774549]: NOTICE [error-bots] Ban 65.111.10.2
...
show less
Bad Web Bot
Web Spam
Email Spam
Blog Spam
Port Scan
Brute-Force
Web App Attack
🇺🇸
drewf.ink
2026-09-29 07:16:20
(1 week ago)
[07:16] Attempted HTTPS GlobalProtect config retrieval with credentials jsmall:Pa*****d1 (getconfig. ...
show more
[07:16] Attempted HTTPS GlobalProtect config retrieval with credentials jsmall:Pa*****d1 (getconfig.esp - some brute-force tooling targets this directly instead of login.esp)
show less
Web App Attack
🇺🇸
drewf.ink
2026-09-28 20:32:14
(1 week ago)
[20:32] Attempted HTTPS GlobalProtect login with credentials jordans:W******1
Web App Attack
🇳🇱
maxxsense
2026-09-11 07:53:56
(4 weeks ago)
(mod_security) mod_security triggered on hostname [redacted] 65.111.10.2 (US/United States/-)
SQL Injection
🇺🇸
eacontent
2026-09-10 09:18:00
(1 month ago)
[Thu Sep 10 03:52:18.971471 2026] [security2:error] [pid 14668:tid 14709] [client 65.111.10.2:10397] ...
show more
[Thu Sep 10 03:52:18.971471 2026] [security2:error] [pid 14668:tid 14709] [client 65.111.10.2:10397] [client 65.111.10.2] ModSecurity: Warning. Pattern match "(?i:(?:\\\\s*?(?:exec|execute).*?(?:\\\\W)xp_cmdshell)|(?:[\\"'`]\\\\s*?!\\\\s*?[\\"'`\\\\w])|(?:from\\\\W+information_schema\\\\W)|(?:(?:(?:current_)?user|database|schema|connection_id)\\\\s*?\\\\([^\\\\)]*?)|(?:[\\"'`];?\\\\s*?(?:select|union|having)\\\\b\\\\s*?[^\\\\s])|(?:\\\\wiif ..." at ARGS:requests[1][body][requests][1][path]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "61"] [id "942190"] [rev "2"] [msg "Detects MSSQL code execution and information gathering attempts"] [data "Matched Data: UNION ALL SELECT found within ARGS:requests[1][body][requests][1][path]: /wp/v2/widgets?author_exclude=11111111000000001111111100000000111111110000000011111111000000001111111100000000111111110000000011111111000000001111111100000000111111110000000011111111000000001111111100000000111111110000000
show less
Web App Attack
🇫🇷
dynamix
2026-09-03 07:02:44
(1 month ago)
Multiple WAF Violations
Web App Attack
🇫🇷
Sklurk
2026-08-16 00:51:22
(1 month ago)
Web App Attack
Web App Attack
🇫🇷
Sklurk
2026-07-09 01:11:57
(3 months ago)
Web App Attack
Web App Attack
🇮🇹
LTM
2026-05-17 06:20:02
(4 months ago)
WebServer - Attempts to exploit
Hacking
Brute-Force
Web App Attack
🇦🇺
RedBear IT
2026-03-26 10:00:37
(6 months ago)
"DDoS against public endpoint"
DDoS Attack
🇺🇸
inspectorgdgt
2025-12-24 22:00:00
(9 months ago)
VPN brute-force login attempts observed (bulk report).
Brute-Force
🇺🇸
TPI-Abuse
2025-11-27 20:53:37
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.10.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.10.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 15:53:30.527784 2025] [security2:error] [pid 1855408:tid 1855464] [client 65.111.10.2:57067] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "danelandia.com"] [uri "/.git/HEAD"] [unique_id "aSi6Sv8uxFESw4R4U0aXrAAAAFU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-27 20:36:16
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.10.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.10.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 15:36:13.233796 2025] [security2:error] [pid 26598:tid 26598] [client 65.111.10.2:53979] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "churchbehindthewalls.com"] [uri "/.env"] [unique_id "aSi2PZF8ese8fY0LUqRo-gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-14 07:38:50
(10 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇺🇸
techboy117
2025-11-14 00:41:07
(10 months ago)
Blocking due to password spraying.
Brute-Force
