Strange Report from LFD

[isputra]

Hi,

I just received report from LFD like below :

--------------------------------------
On Sat Feb 17 19:45:20 2007, the Login Failure Daemon detected 207.58.149.229 (transfer.cpanel11.com) generating 9 (mod_security) login failures within the last 230 seconds and was blocked.

Log entries:

[Sat Feb 17 19:45:16 2007] [error] [client 207.58.149.229] mod_security: Access denied with code 406. Pattern match "adxmlrpc.php" at REQUEST_URI [uri "/adxmlrpc.php"]
[Sat Feb 17 19:45:16 2007] [error] [client 207.58.149.229] mod_security: Access denied with code 406. Pattern match "adxmlrpc.php" at REQUEST_URI [uri "/adxmlrpc.php"]
[Sat Feb 17 19:45:16 2007] [error] [client 207.58.149.229] mod_security: Access denied with code 406. Pattern match "adxmlrpc.php" at REQUEST_URI [uri "/adxmlrpc.php"]
[Sat Feb 17 19:45:16 2007] [error] [client 207.58.149.229] mod_security: Access denied with code 406. Pattern match "adxmlrpc.php" at REQUEST_URI [uri "/adserver/adxmlrpc.php"]
[Sat Feb 17 19:45:16 2007] [error] [client 207.58.149.229] mod_security: Access denied with code 406. Pattern match "adxmlrpc.php" at REQUEST_URI [uri "/adserver/adxmlrpc.php"]
[Sat Feb 17 19:45:16 2007] [error] [client 207.58.149.229] mod_security: Access denied with code 406. Pattern match "adxmlrpc.php" at REQUEST_URI [uri "/adserver/adxmlrpc.php"]
[Sat Feb 17 19:45:16 2007] [error] [client 207.58.149.229] mod_security: Access denied with code 406. Pattern match "adxmlrpc.php" at REQUEST_URI [uri "/phpAdsNew/adxmlrpc.php"]
[Sat Feb 17 19:45:16 2007] [error] [client 207.58.149.229] mod_security: Access denied with code 406. Pattern match "adxmlrpc.php" at REQUEST_URI [uri "/phpAdsNew/adxmlrpc.php"]
[Sat Feb 17 19:45:16 2007] [error] [client 207.58.149.229] mod_security: Access denied with code 406. Pattern match "adxmlrpc.php" at REQUEST_URI [uri "/adxmlrpc.php"]
---------------------------------

Yes, its from cpanel or maybe from cpanel because the domain looks like from cpanel. Is it true the ip and domain from cpanel ?

 

[verdon]

Do a whois on it... I don't think that has anything to do with cpanel. The domain is owned by somebody from India.