🇩🇪
big-cloud.nl
2026-05-30 22:27:57
(2 weeks ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-02-20 09:50:24
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 65.111.25.47 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 65.111.25.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 20 04:50:20.318095 2026] [security2:error] [pid 812:tid 812] [client 65.111.25.47:37851] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||russellhouse.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "russellhouse.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aZguXLa86McNF2JjJGirHAAAAAI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-13 12:34:28
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.25.47 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.25.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 13 07:34:23.695316 2026] [security2:error] [pid 2057940:tid 2057940] [client 65.111.25.47:47749] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jodstar.com"] [uri "/.git/HEAD"] [unique_id "aWY7z0z3QSIh1zXUw1DK4gAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Packets-Decreaser.NET
2025-12-29 14:01:02
(5 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
TPI-Abuse
2025-12-04 16:04:02
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.25.47 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.25.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 04 11:03:53.676701 2025] [security2:error] [pid 21789:tid 21789] [client 65.111.25.47:47231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "malinka.us"] [uri "/.env"] [unique_id "aTGw6XkC0c_hZ2XEoe35fAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 06:48:35
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.25.47 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.25.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 01:48:29.151898 2025] [security2:error] [pid 20634:tid 20634] [client 65.111.25.47:21029] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "annropp.com"] [uri "/.git/HEAD"] [unique_id "aSP_vV5_pt8qGr6cKIDSPAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 05:47:46
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.25.47 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.25.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:47:42.175317 2025] [security2:error] [pid 5223:tid 5230] [client 65.111.25.47:33317] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ainavelas.com"] [uri "/.git/HEAD"] [unique_id "aSPxfmBLaC45odtmKAmkAwAAAEE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 05:20:35
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.25.47 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.25.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:20:28.556969 2025] [security2:error] [pid 17857:tid 17857] [client 65.111.25.47:59053] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.furfriend-z.com"] [uri "/.git/HEAD"] [unique_id "aSPrHGcaEbM_KuzQEALWDwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-21 18:56:07
(6 months ago)
This IP was involved in an brute force and password spray attack on 2025/11/21 12:50:55
Port Scan
Brute-Force
Exploited Host
Web App Attack
🇮🇩
BPS-StatisticsIndonesia
2025-10-28 17:27:40
(7 months ago)
WP Admin Scan Activities
Web App Attack
🇪🇸
el-brujo
2025-10-24 02:24:45
(7 months ago)
24/Oct/2025:04:24:44.087928 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
24/Oct/2025:04:24:44.087928 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 65.111.25.47] ModSecurity: Warning. Match of "rx ^[\\\\\\\\w/.+-]+(?:\\\\\\\\s?;\\\\\\\\s?(?:action|boundary|charset|type|start(?:-info)?)\\\\\\\\s?=\\\\\\\\s?['\\\\"\\\\\\\\w.()+,/:=?<>@-]+)*$" against "REQUEST_HEADERS:Content-Type" required. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "933"] [id "920470"] [msg "Illegal Content-Type header"] [data "application/x-www-form-urlencoded, application/x-www-form-urlencoded"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "foro.elhacker.net"] [uri "/wp-login.php"] [unique_id "aPrjbL6eb47lIA_ehPiJNQAByww"]
...
show less
Hacking
Web App Attack
🇧🇪
ingroscart.it
2025-02-09 17:41:30
(1 year ago)
(plesk-panel) Failed plesk-panel login with username [redacted] from 65.111.25.47 (US/United States/ ...
show more
(plesk-panel) Failed plesk-panel login with username [redacted] from 65.111.25.47 (US/United States/-)
show less
Brute-Force
2024-10-18 11:45:06
(1 year ago)
Automatic report - Vulnerability scan
/RDWeb/Pages/en-US/login.aspx
Web App Attack
2024-07-12 05:48:38
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2024-07-09 03:02:25
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH