🇺🇸
193.36.224.34
08 Sep 2025
Brute-Force
🇵🇪
167.250.204.82
05 Sep 2025
Sep 4 20:14:19 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:4 ...
show more
Sep 4 20:14:19 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:42:90:78:97:08:00 SRC=167.250.204.82 DST=46.105.123.37 LEN=52 TOS=0x00 PREC=0x00 TTL=108 ID=35293 DF PROTO=TCP SPT=63646 DPT=22 WINDOW=64240 RES=0x00 SYN URGP=0
Sep 4 20:14:20 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:42:90:78:97:08:00 SRC=167.250.204.82 DST=46.105.123.37 LEN=52 TOS=0x00 PREC=0x00 TTL=108 ID=35314 DF PROTO=TCP SPT=63646 DPT=22 WINDOW=64240 RES=0x00 SYN URGP=0
Sep 4 20:14:22 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:42:90:78:97:08:00 SRC=167.250.204.82
show less
Port Scan
🇩🇪
213.136.84.241
19 Jul 2025
Jul 19 10:19:54 server kernel: Firewall: *ConnLimit* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:42:90: ...
show more
Jul 19 10:19:54 server kernel: Firewall: *ConnLimit* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:42:90:78:97:08:00 SRC=213.136.84.241 DST=46.105.123.37 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=4360 DF PROTO=TCP SPT=53236 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0
Jul 19 10:19:54 server kernel: Firewall: *ConnLimit* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:42:90:78:97:08:00 SRC=213.136.84.241 DST=46.105.123.37 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=56247 DF PROTO=TCP SPT=53214 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0
show less
Port Scan
🇫🇷
185.177.72.12
19 Jul 2025
[Sat Jul 19 09:30:16.637182 2025] [:error] [pid 32024:tid 32028] [client 185.177.72.12:43778] [clien ...
show more
[Sat Jul 19 09:30:16.637182 2025] [:error] [pid 32024:tid 32028] [client 185.177.72.12:43778] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "46.105.123.37"] [uri "/.env"] [unique_id "aHud6LeIUM8atrAMG0c6NgAAAAA"]
show less
Web App Attack
🇮🇪
40.113.94.202
19 Jul 2025
[Fri Jul 18 08:05:23.640350 2025] [:error] [pid 15741:tid 15750] [client 40.113.94.202:56494] File d ...
show more
[Fri Jul 18 08:05:23.640350 2025] [:error] [pid 15741:tid 15750] [client 40.113.94.202:56494] File does not exist: /usr/local/apache/htdocs/html.php
[Fri Jul 18 08:05:23.662881 2025] [:error] [pid 15741:tid 15747] [client 40.113.94.202:56496] File does not exist: /usr/local/apache/htdocs/ioxi-o.php
[Fri Jul 18 08:05:23.753615 2025] [:error] [pid 15741:tid 15757] [client 40.113.94.202:56504] File does not exist: /usr/local/apache/htdocs/hehehehe.php
[Fri Jul 18 08:05:23.776246 2025] [:error] [pid 15741:tid 15765] [client 40.113.94.202:56506] File does not exist: /usr/local/apache/htdocs/chosen.php
[Fri Jul 18 08:05:23.848716 2025] [:error] [pid 20576:tid 20593] [client 40.113.94.202:56512] File does not exist: /usr/local/apache/htdocs/wp-links.php
[Fri Jul 18 08:05:23.895942 2025] [:error] [pid 15741:tid 15769] [client 40.113.94.202:56516] File does not exist: /usr/local/apache/htdocs/dropdown.php
show less
Web App Attack
🇫🇷
185.177.72.144
19 Jul 2025
[Fri Jul 18 18:49:30.870415 2025] [:error] [pid 15741:tid 15746] [client 185.177.72.144:42038] [clie ...
show more
[Fri Jul 18 18:49:30.870415 2025] [:error] [pid 15741:tid 15746] [client 185.177.72.144:42038] [client 185.177.72.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.alexisperezluna.com"] [uri "/backend/.env"] [unique_id "aHrPeoP3qt0aAVIi6bpJxwAAAAE"]
show less
Hacking
Web App Attack
🇨🇴
190.60.56.234
08 Jul 2025
Jul 07 15:06:15 imap-login: Info: Disconnected (auth failed, 1 attempts in 65 secs)
Jul 07 15:03:25 ...
show more
Jul 07 15:06:15 imap-login: Info: Disconnected (auth failed, 1 attempts in 65 secs)
Jul 07 15:03:25 imap-login: Info: Disconnected (auth failed, 1 attempts in 2 secs)
Jul 07 15:38:42 imap-login: Info: Disconnected (auth failed, 1 attempts in 9 secs)
show less
Hacking
Brute-Force
🇧🇪
35.240.63.222
08 Jul 2025
Jul 7 18:32:19 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:4 ...
show more
Jul 7 18:32:19 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:42:90:78:97:08:00 SRC=35.240.63.222 DST=46.105.123.37 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=133 PROTO=TCP SPT=47489 DPT=444 WINDOW=1024 RES=0x00 SYN URGP=0
Jul 7 18:32:50 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:28:af:fd:72:de:1f:08:00 SRC=35.240.63.222 DST=46.105.123.37 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=9865 PROTO=TCP SPT=47489 DPT=646 WINDOW=1024 RES=0x00 SYN URGP=0
Jul 7 18:32:51 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:28:af:fd:72:de:1f:08:00 SRC=35.240.63.222 DST=46.105.123.37 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=45320 PROTO=TCP SPT=47489 DPT=9 WINDOW=1024 RES=0x00 SYN URGP=0
show less
Port Scan
🇭🇰
103.57.248.106
08 Jul 2025
[Mon Jul 07 22:59:24.853910 2025] [:error] [pid 6715:tid 6789] [client 103.57.248.106:55402] [client ...
show more
[Mon Jul 07 22:59:24.853910 2025] [:error] [pid 6715:tid 6789] [client 103.57.248.106:55402] [client 103.57.248.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:\\\\b(?:c(?:d(?:\\\\b[^a-zA-Z0-9_]{0,}?[\\\\/]|[^a-zA-Z0-9_]{0,}?\\\\.\\\\.)|hmod.{0,40}?\\\\+.{0,3}x|md(?:\\\\b[^a-zA-Z0-9_]{0,}?\\\\/c|(?:\\\\.exe|32)\\\\b))|(?:echo\\\\b[^a-zA-Z0-9_]{0,}?\\\\by{1,}|n(?:et(?:\\\\b[^a-zA-Z0-9_]{1,}?\\\\blocalgroup|\\\\.exe)|(?:c|map)\\\\.exe)|t(? ..." at MATCHED_VAR. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "65"] [id "211210"] [rev "8"] [msg "COMODO WAF: System Command Injection||cpanel.corpdharma.com|F|2"] [data "Matched Data: `id found within ARGS:t_total: `id`"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.corpdharma.com"] [uri "/test/index.php"] [unique_id "aGyJjKErVFFzRMSHA-HUVAAAAJI"]
show less
Hacking
Bad Web Bot
Web App Attack
🇫🇷
178.33.134.25
28 Jun 2025
[Sat Jun 28 16:14:00.773221 2025] [:error] [pid 14992:tid 15037] [client 178.33.134.25:56960] [clien ...
show more
[Sat Jun 28 16:14:00.773221 2025] [:error] [pid 14992:tid 15037] [client 178.33.134.25:56960] [client 178.33.134.25] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.silvertrading.com.ve|F|2"] [data ".web.ui.webresource.axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.silvertrading.com.ve"] [uri "/Telerik.Web.UI.WebResource.axd"] [unique_id "aGBNCMC1REuUzhDT9UKTJAAAAE8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
35.233.7.110
28 Jun 2025
Jun 26 03:50:20 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:28:af:f ...
show more
Jun 26 03:50:20 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:28:af:fd:72:de:1f:08:00 SRC=35.233.7.110 DST=46.105.123.37 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=62035 PROTO=TCP SPT=44160 DPT=22 WINDOW=1024 RES=0x00 SYN URGP=0
show less
Port Scan
🇧🇪
35.240.117.26
28 Jun 2025
Jun 25 20:02:51 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:4 ...
show more
Jun 25 20:02:51 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:42:90:78:97:08:00 SRC=35.240.117.26 DST=46.105.123.37 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=54269 PROTO=TCP SPT=56129 DPT=37 WINDOW=1024 RES=0x00 SYN URGP=0
Jun 25 20:03:02 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:42:90:78:97:08:00 SRC=35.240.117.26 DST=46.105.123.37 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=19457 PROTO=TCP SPT=56129 DPT=119
show less
Port Scan
🇫🇷
170.39.218.61
28 Jun 2025
[Fri Jun 27 19:55:17.239317 2025] [:error] [pid 4738:tid 4752] [client 170.39.218.61:42166] [client ...
show more
[Fri Jun 27 19:55:17.239317 2025] [:error] [pid 4738:tid 4752] [client 170.39.218.61:42166] [client 170.39.218.61] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.corpdharma.com"] [uri "/.env"] [unique_id "aF8vZfidfAVnR1Qz7o1i7QAAAAo"]
show less
Web Spam
Hacking
Bad Web Bot
Web App Attack
🇮🇱
82.80.249.236
28 Jun 2025
Jun 27 22:33:07 server kernel: Firewall: *ConnLimit* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:28:af:fd:72: ...
show more
Jun 27 22:33:07 server kernel: Firewall: *ConnLimit* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:28:af:fd:72:de:1f:08:00 SRC=82.80.249.236 DST=46.105.123.37 LEN=52 TOS=0x02 PREC=0x00 TTL=113 ID=45866 DF PROTO=TCP SPT=63759 DPT=443 WINDOW=64240 RES=0x00 CWR ECE SYN URGP=0
Jun 27 22:33:07 server kernel: Firewall: *ConnLimit* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:42:90:78:97:08:00 SRC=82.80.249.236 DST=46.105.123.37 LEN=52 TOS=0x02 PREC=0x00 TTL=113 ID=45869 DF PROTO=TCP SPT=63781 DPT=443 WINDOW=64240 RES=0x00 CWR ECE SYN URGP=0
Jun 27 22:33:07 server kernel: Firewall: *ConnLimit* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:d0:e0:42:90:78:97:08:00 SRC=82.80.249.236 DST=46.105.123.37 LEN=52 TOS=0x02 PREC=0x00 TTL=114 ID=45871 DF PROTO=TCP SPT=63802 DPT=443 WINDOW=64240 RES=0x00 CWR ECE SYN URGP=0
show less
DDoS Attack
Port Scan
🇮🇱
82.80.249.252
28 Jun 2025
Jun 28 06:32:14 server kernel: Firewall: *ConnLimit* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:28:af:fd:72: ...
show more
Jun 28 06:32:14 server kernel: Firewall: *ConnLimit* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:28:af:fd:72:de:1f:08:00 SRC=82.80.249.252 DST=46.105.123.37 LEN=52 TOS=0x02 PREC=0x00 TTL=112 ID=44319 DF PROTO=TCP SPT=51042 DPT=443 WINDOW=64240 RES=0x00 CWR ECE SYN URGP=0
Jun 28 06:32:14 server kernel: Firewall: *ConnLimit* IN=eth0 OUT= MAC=00:30:48:be:e8:cc:28:af:fd:72:de:1f:08:00 SRC=82.80.249.252 DST=46.105.123.37 LEN=52 TOS=0x02 PREC=0x00 TTL=114 ID=44320 DF PROTO=TCP SPT=51132 DPT=443 WINDOW=64240 RES=0x00 CWR ECE SYN URGP=0
show less
DDoS Attack
Port Scan
🇮🇳
13.233.84.169
22 Jun 2025
Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES.
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇺🇸
84.239.43.26
22 Jun 2025
Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.we ...
show more
Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:user-agent.
show less
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇫🇷
185.177.72.111
22 Jun 2025
Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI.
DDoS Attack
Web Spam
Hacking
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
84.239.45.145
22 Jun 2025
Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.we ...
show more
Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent.
show less
DDoS Attack
Web Spam
Hacking
SQL Injection
Web App Attack
🇺🇸
84.239.47.150
22 Jun 2025
Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.we ...
show more
Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent.
DDos Attack
show less
DDoS Attack
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
🇺🇸
84.239.47.86
22 Jun 2025
Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.we ...
show more
Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent.
DDos Attack
show less
DDoS Attack
Web Spam
Hacking
SQL Injection
Web App Attack
🇩🇪
109.199.114.134
21 Jun 2025
Time: Fri Jun 20 22:40:23 2025 -0400
IP: 109.199.114.134 (DE/Germany/North Rhine-Westphalia ...
show more
Time: Fri Jun 20 22:40:23 2025 -0400
IP: 109.199.114.134 (DE/Germany/North Rhine-Westphalia/Düsseldorf/vmi1676252.contaboserver.net)
Hits: 11
Blocked: Temporary Block for 3600 seconds [PS_LIMIT]
Time: Fri Jun 20 14:50:52 2025 -0400
IP: 109.199.114.134 (DE/Germany/North Rhine-Westphalia/Düsseldorf/vmi1676252.contaboserver.net)
Hits: 11
Blocked: Temporary Block for 3600 seconds [PS_LIMIT]
Time: Fri Jun 20 02:58:56 2025 -0400
IP: 109.199.114.134 (DE/Germany/North Rhine-Westphalia/Düsseldorf/vmi1676252.contaboserver.net)
Hits: 11
Blocked: Temporary Block for 3600 seconds [PS_LIMIT]
Port Scan
show less
Port Scan