🇳🇱
Savvii
2026-10-21 14:05:32
(22 hours ago)
15 attempts against mh-modsecurity-ban on pavo
Brute-Force
Web App Attack
🇳🇱
Savvii
2026-10-21 13:48:47
(22 hours ago)
15 attempts against mh-modsecurity-ban on eris
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-08-23 07:38:43
(1 month ago)
121 requests with url.path *.php.bak
Brute-Force
Bad Web Bot
2026-08-23 07:25:09
(1 month ago)
Blocked by ModSec and CSF
Port Scan
🇺🇸
TPI-Abuse
2026-08-23 05:00:56
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 213.152.161.98 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 213.152.161.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 01:00:41.880745 2026] [security2:error] [pid 29832:tid 29832] [client 213.152.161.98:33416] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.themadwriter.us"] [uri "/wp-config.php.bk"] [unique_id "aop-ef3CrY3iRC0UEUINNwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇭
thaizone.com
2026-08-23 04:46:24
(1 month ago)
Brute Force Attack on a Web Resources (repeated 404) #1
DDoS Attack
Web Spam
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 03:18:37
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 213.152.161.98 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 213.152.161.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 23:18:32.895205 2026] [security2:error] [pid 19277:tid 19277] [client 213.152.161.98:41062] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.starcrestsales.com"] [uri "/.env.production"] [unique_id "aopmiHjEHTA1oDAGyDcOygAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
wristhulk
2026-08-23 02:27:55
(1 month ago)
Honeypot: RDP brute-force on OpenCanary honeypot (port 3389). Username: 'Test'.
Brute-Force
🇫🇮
paissangroup
2026-08-23 01:53:01
(1 month ago)
Multiple WAF Violations
Web App Attack
2026-08-22 23:46:05
(1 month ago)
Bot / scanning and/or hacking attempts: GET /wp-config.php.inc HTTP/1.1, GET /wp-config.php-backup H ...
show more
Bot / scanning and/or hacking attempts: GET /wp-config.php.inc HTTP/1.1, GET /wp-config.php-backup HTTP/1.1, GET /wp-config.php.txt HTTP/1.1, GET /wp-config.php.OLD HTTP/1.1, GET /wp-config.php.swp HTTP/1.1, GET /wp-config.php.old HTTP/1.1, GET /wp-config.php_orig HTTP/1.1, GET /wp-config.php.original HTTP/1.1, GET /wp-config.old HTTP/1.1, GET /wp-config.php.dist HTTP/1.1, GET /wp-config.backup HTTP/1.1, GET /wp-config.php.save HTTP/1.1, GET /wp-config.php.orig HTTP/1.1, GET /wp-config.php.SAVE HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /wp-config-backup.txt HTTP/1.1, GET /wp-config.txt HTTP/1.1, GET /wp-config.inc HTTP/1.1, GET /.wp-config.php.swp HTTP/1.1, GET /wp-config.php HTTP/1.1, GET /wp-config.php.bk HTTP/1.1, GET /wp-config.php.BAK HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET /wp-config.php.html HTTP/1.1, GET /wp-config-sample.php HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-22 23:31:28
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 213.152.161.98 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 213.152.161.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 19:31:11.889949 2026] [security2:error] [pid 10112:tid 10126] [client 213.152.161.98:39526] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.quantumgaze.com"] [uri "/wp-config.php.original"] [unique_id "aooxP64CAfa-iU83R57owAAAAEs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
dyln
2026-08-22 23:22:16
(1 month ago)
Dyls honeypot brute-force: RDP (2 total hits)
Brute-Force
🇩🇪
Hazzard
2026-08-22 22:12:14
(1 month ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted]): (CF_ENABLE)
Port Scan
🇺🇸
Neosmith20
2026-08-22 21:27:59
(1 month ago)
Knock-Knock honeypot brute-force: RDP (1 total hits)
Brute-Force
🇺🇸
TPI-Abuse
2026-08-22 20:43:28
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 213.152.161.98 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 213.152.161.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 16:43:15.071171 2026] [security2:error] [pid 23467:tid 23467] [client 213.152.161.98:38254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.nwtree.com"] [uri "/.wp-config.php.swp"] [unique_id "aooJ4xMhiwrvG7vNfqOO8wAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack