2026-10-29 15:55:26
(10 minutes ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 07:04:57
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 185.238.231.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 03:04:51.865956 2026] [security2:error] [pid 7321:tid 7321] [client 185.238.231.164:58575] ...
show more
(mod_security) mod_security (id:210492) triggered by 185.238.231.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 03:04:51.865956 2026] [security2:error] [pid 7321:tid 7321] [client 185.238.231.164:58575] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "haqrry.banis-associates.com"] [uri "/old/.env"] [unique_id "auGek-zHZNHp8Gkfe1OiTgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
neckaralb-admin.de
2026-10-23 05:42:44
(6 days ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
nyt
2026-10-21 23:25:40
(1 week ago)
WP login POST blocked by WAF
Brute-Force
Web App Attack
🇳🇴
jad-abuse
2026-10-18 20:06:57
(1 week ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe, git_exposure, db_dump, source_backup. Observed by 1 sensor(s); 14 hits.
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 16:30:34
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.238.231.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 12:30:30.554132 2026] [security2:error] [pid 15494:tid 15494] [client 185.238.231.164:4007 ...
show more
(mod_security) mod_security (id:210492) triggered by 185.238.231.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 12:30:30.554132 2026] [security2:error] [pid 15494:tid 15494] [client 185.238.231.164:40075] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "flavornet.org"] [uri "/.env"] [unique_id "atT0JhLLKmkwSU5pKoDRBAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 11:21:50
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 185.238.231.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 07:21:45.734247 2026] [security2:error] [pid 9368:tid 9410] [client 185.238.231.164:45703] ...
show more
(mod_security) mod_security (id:210492) triggered by 185.238.231.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 07:21:45.734247 2026] [security2:error] [pid 9368:tid 9410] [client 185.238.231.164:45703] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.wpe.uk.com"] [uri "/conf/.env"] [unique_id "as9lye3HjJCf1zf_7evJ0AAAAY0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-14 08:15:30
(2 weeks ago)
[14/Oct/2026:11:15:30 +0300] -- 185.238.231.164 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /.env HTTP/1.1
Bad Web Bot
Web App Attack
🇦🇺
afleventoffice.com.au
2026-09-27 23:27:12
(1 month ago)
GET / HTTP/1.1
Web App Attack
🇩🇪
IVski.com
2026-09-24 15:39:36
(1 month ago)
IVski WAF | WordPress scanner detected - probing wp-includes/wlwmanifest.xml
Hacking
Brute-Force
Web App Attack
🇮🇹
CoreTech srl
2026-09-09 08:38:57
(1 month ago)
cloudlinux2 fail2ban: 2026-09-09 10:33:56,155 fail2ban.filter [1892]: INFO [plesk-wordpress] Found 185.238.231.200 - 2026-09-09 10:33:56cloudlinux2 fail2ban: 2026-09-09 10:33:53,523 fail2ban.filter [1892]: INFO [plesk-wordpress] ...
show more
cloudlinux2 fail2ban: 2026-09-09 10:33:56,155 fail2ban.filter [1892]: INFO [plesk-wordpress] Found 185.238.231.200 - 2026-09-09 10:33:56cloudlinux2 fail2ban: 2026-09-09 10:33:53,523 fail2ban.filter [1892]: INFO [plesk-wordpress] Found 185.238.231.37 - 2026-09-09 10:33:53cloudlinux2 fail2ban: 2026-09-09 10:34:01,806 fail2ban.filter [1892]: INFO [plesk-wordpress] Found 185.238.231.169 - 2026-09-09 10:34:01cloudlinux2 fail2ban: 2026-09-09 10:34:22,099 fail2ban.filter [1892]: INFO [plesk-wordpress] Found 173.239.211.17 - 2026-09-09 10:34:21cloudlinux2 fail2ban: 2026-09-09 10:34:18,293 fail2ban.actions [1892]: NOTICE [plesk-modsecurity] Unban 106.219.177.247cloudlinux2 fail2ban: 2026-09-09 10:34:54,825 fail2ban.filter [1892]: INFO [plesk-wordpress] Found 185.238.231.183 - 2026-09-09 10:34:54cloudlinux2 fail2ban: 2026-09-09 10:34:52,767 fail2ban.filter [1892]: INFO [plesk-wordpress] Found 185.238.231.164 - 2026-09-09 10:34:52cloudlinux2 fail2
show less
Web App Attack
🇫🇷
dynamix
2026-09-09 03:26:35
(1 month ago)
WordPress wp-login.php Brute Force Attack
Brute-Force
Web App Attack
🇺🇦
URAN Publishing Service
2026-08-24 09:45:44
(2 months ago)
[24/Aug/2026:12:45:44 +0300] -- 185.238.231.164 Ban reason: User-Agent Go-http-client
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-08-15 07:06:48
(2 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-08-14 01:06:48
(2 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
