|
🇳🇨
ACE-INFORMATIQUE.NC
|
|
Malicious CGI/web attack blocked by Fail2ban
|
Web App Attack
|
|
🇨🇦
DRI
|
|
Web attack/Malicious activity detected
|
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:217210) triggered by 74.0.101.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 00:23:09.050994 2026] [security2:error] [pid 21186:tid 21186] [client 74.0.101.104:59429] Mod ...
show more
(mod_security) mod_security (id:217210) triggered by 74.0.101.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 00:23:09.050994 2026] [security2:error] [pid 21186:tid 21186] [client 74.0.101.104:59429] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||ladylilacfarm.com|F|4"] [data "GET http://ladylilacfarm.com HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ladylilacfarm.com"] [uri "/"] [unique_id "arNULbgR480ATFP74s0wLgAAAAo"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
ghostwarriors
|
|
Attempts against non-existent wp-login
|
Brute-Force
Web App Attack
|
|
🇩🇪
yitzhaq
|
|
74.0.101.104 - - [23/Sep/2026:02:13:39 +0200] "GET http://[site]/wp-json/ HTTP/1.1" 301 534 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
74.0.101.104 - - [23/Sep/2026:02:13:37 + ...
show more
74.0.101.104 - - [23/Sep/2026:02:13:39 +0200] "GET http://[site]/wp-json/ HTTP/1.1" 301 534 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
74.0.101.104 - - [23/Sep/2026:02:13:37 +0200] "GET /wp-login.php HTTP/1.1" 404 4732 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
74.0.101.104 - - [23/Sep/2026:02:13:37 +0200] "GET /wp-json/ HTTP/1.1" 404 459 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
74.0.101.104 - - [23/Sep/2026:02:13:37 +0200] "POST /xmlrpc.php HTTP/1.1" 403 462 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
74.0.101.104 - - [23/Sep/2026:02:13:38 +0200] "GET /robots.txt HTTP/1.1" 404 459 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/
show less
|
Open Proxy
|
|
🇳🇱
wlt-blocker
|
|
Unauthorized access to webpage admin
|
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:217210) triggered by 74.0.101.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:41:21.070644 2026] [security2:error] [pid 22328:tid 22328] [client 74.0.101.104:20351] Mod ...
show more
(mod_security) mod_security (id:217210) triggered by 74.0.101.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:41:21.070644 2026] [security2:error] [pid 22328:tid 22328] [client 74.0.101.104:20351] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||susansimmons.net|F|4"] [data "GET http://susansimmons.net HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "susansimmons.net"] [uri "/"] [unique_id "arKvsXsE0Kbrp6Nsc_lcHAAAAA0"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:217210) triggered by 74.0.101.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 20:01:23.778559 2026] [security2:error] [pid 29427:tid 29427] [client 74.0.101.104:19232] Mod ...
show more
(mod_security) mod_security (id:217210) triggered by 74.0.101.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 20:01:23.778559 2026] [security2:error] [pid 29427:tid 29427] [client 74.0.101.104:19232] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||gonzalez.com|F|4"] [data "GET http://gonzalez.com HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "gonzalez.com"] [uri "/"] [unique_id "arHFU3z6dBBFtnb4ze5WpwAAAA8"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇳🇱
Alt255
|
|
[ti-30al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 74.0.101.104 - - [20/Sep/2026:00:57:17 +0200] "POST /xmlrpc.php HTTP/1.1" 301 564 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac ...
show more
[ti-30al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 74.0.101.104 - - [20/Sep/2026:00:57:17 +0200] "POST /xmlrpc.php HTTP/1.1" 301 564 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"
74.0.101.104 - - [20/Sep/2026:00:57:24 +0200] "POST /xmlrpc.php HTTP/1.1" 301 564 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
74.0.101.104 - - [20/Sep/2026:00:57:25 +0200] "POST /xmlrpc.php HTTP/1.1" 301 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0"
74.0.101.104 - - [20/Sep/2026:00:57:25 +0200] "POST /xmlrpc.php HTTP/1.1" 301 564 "-" "Mozilla/5.0 (Maci
...
show less
|
Brute-Force
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:217210) triggered by 74.0.101.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 14:26:21.129232 2026] [security2:error] [pid 31611:tid 31611] [client 74.0.101.104:59813] Mod ...
show more
(mod_security) mod_security (id:217210) triggered by 74.0.101.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 14:26:21.129232 2026] [security2:error] [pid 31611:tid 31611] [client 74.0.101.104:59813] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||thresholddigital.com|F|4"] [data "GET http://thresholddigital.com HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "thresholddigital.com"] [uri "/"] [unique_id "aq7TzZ47KAH_wGN3piXTbwAAABA"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇪🇸
Mugen
|
|
Unauthorized VPN login attempts
|
Brute-Force
|
|
🇺🇸
fbarela
|
|
FortiGate SSL VPN login failures.
|
Brute-Force
Hacking
|
