🇫🇮
YF
2026-09-16 02:00:30
(1 month ago)
WordPress directory enumeration
Web App Attack
🇬🇷
setupgr
2026-09-16 01:41:38
(1 month ago)
(mod_security) mod_security (id:11000011) triggered by 169.58.234.134 (FR/France/Bas-Rhin/Lauterbourg/-/[AS51167 Contabo GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Wed Sep 16 04:41:34.472552 2 ...
show more
(mod_security) mod_security (id:11000011) triggered by 169.58.234.134 (FR/France/Bas-Rhin/Lauterbourg/-/[AS51167 Contabo GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Wed Sep 16 04:41:34.472552 2026] [security2:error] [pid 1197260:tid 1197405] [client 169.58.234.134:61878] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "contaboserver.net" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: vmi3532747.contaboserver.net"] [severity "CRITICAL"] [hostname "pankoskal.gr"] [uri "/wp-admin/css/"] [unique_id "aqnzzqPfUNPNpXbEwDqW-AAAAwc"]
show less
Port Scan
🇦🇺
A.i.D.A.N.N
2026-09-15 16:33:13
(1 month ago)
A.i.D.A.N.N: Anomaly Detected - Signature match Web Service - Web vulnerability scanning detected
Web App Attack
2026-09-15 03:03:47
(1 month ago)
169.58.234.134 - - [15/Sep/2026:11:03:47 +0800] "GET /cgi-bin/ HTTP/1.1" 301 243 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
...
Bad Web Bot
Web App Attack
🇭🇷
bubausluge
2026-09-14 10:07:39
(1 month ago)
Blocked by https://aegis.hr — Web Scanner - (MITRE T1595.001), 6 attempts, Period: 2026-09-12 17:06:15 to 2026-09-12 17:06:15
Web App Attack
Bad Web Bot
🇳🇱
svr
2026-09-14 09:54:10
(1 month ago)
Abusive Automated Web Scanner
Web App Attack
🇦🇺
2000cn.com.au
2026-09-14 06:26:27
(1 month ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-admin-interface-probing
Web App Attack
Hacking
🇬🇧
andypiper
2026-09-14 01:01:32
(1 month ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇩🇪
expandmade.com
2026-09-14 00:13:51
(1 month ago)
keeps trying to use admin area w/o authorization [14/Sep/2026:00:13:51 "GET /wp-admin/"]
Web App Attack
🇬🇷
setupgr
2026-09-14 00:12:15
(1 month ago)
(mod_security) mod_security (id:11000011) triggered by 169.58.234.134 (FR/France/Bas-Rhin/Lauterbourg/-/[AS51167 Contabo GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Mon Sep 14 03:12:12.092148 2 ...
show more
(mod_security) mod_security (id:11000011) triggered by 169.58.234.134 (FR/France/Bas-Rhin/Lauterbourg/-/[AS51167 Contabo GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Mon Sep 14 03:12:12.092148 2026] [security2:error] [pid 309293:tid 309395] [client 169.58.234.134:60184] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "contaboserver.net" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: vmi3532747.contaboserver.net"] [severity "CRITICAL"] [hostname "ftiaxtomonosou.gr"] [uri "/wp-admin/css/"] [unique_id "aqc73NHcHoipWMLF9BIdxAAAAwE"]
show less
Port Scan
🇦🇺
2000cn.com.au
2026-09-12 14:47:53
(1 month ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-admin-interface-probing
Web App Attack
Hacking
🇬🇷
setupgr
2026-09-12 09:47:46
(1 month ago)
(mod_security) mod_security (id:11000011) triggered by 169.58.234.134 (FR/France/Bas-Rhin/Lauterbourg/-/[AS51167 Contabo GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Sep 12 12:47:41.964133 2 ...
show more
(mod_security) mod_security (id:11000011) triggered by 169.58.234.134 (FR/France/Bas-Rhin/Lauterbourg/-/[AS51167 Contabo GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Sep 12 12:47:41.964133 2026] [security2:error] [pid 2901:tid 3024] [client 169.58.234.134:51505] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "contaboserver.net" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: vmi3532747.contaboserver.net"] [severity "CRITICAL"] [hostname "fashionfragonard.gr"] [uri "/wp-admin/css/"] [unique_id "aqUfvf2Dp4aKcsYZe5r4ngAAAow"]
show less
Port Scan
🇬🇧
consul.to
2026-09-12 02:16:56
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
kosada.com
2026-09-11 08:19:50
(1 month ago)
Repeated requests for suspicious nonexistent URLs, for example: /wp-admin/maint/ (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36")
Web App Attack
🇵🇱
gandaflux
2026-09-11 07:36:45
(1 month ago)
169.58.234.134 [redacted-domain] - [11/Sep/2026:09:32:09 +0200] "GET /wp-admin/css/ HTTP/1.1" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
169.58.234.134 [redacted-domai ...
show more
169.58.234.134 [redacted-domain] - [11/Sep/2026:09:32:09 +0200] "GET /wp-admin/css/ HTTP/1.1" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
169.58.234.134 [redacted-domain] - [11/Sep/2026:09:32:11 +0200] "GET /wp-admin/css/colors/ HTTP/1.1" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
169.58.234.134 [redacted-domain] - [11/Sep/2026:09:32:39 +0200] "GET /wp-admin/maint/ HTTP/1.1" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
169.58.234.134 [redacted-domain] - [11/Sep/2026:09:32:46 +0200] "GET /wp-admin/js/ HTTP/1.1" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
169.58.234.134 [redacted-domain] - [11/Sep/2026:09:33:04 +0200
show less
Bad Web Bot
Web App Attack
