🇺🇸
lostswordfish.com
2026-10-29 18:44:04
(2 days ago)
Wordfence waf block on illinoisvoices
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 07:05:01
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 185.238.231.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 03:04:55.781307 2026] [security2:error] [pid 12103:tid 12103] [client 185.238.231.168:3864 ...
show more
(mod_security) mod_security (id:210492) triggered by 185.238.231.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 03:04:55.781307 2026] [security2:error] [pid 12103:tid 12103] [client 185.238.231.168:38647] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "haqrry.banis-associates.com"] [uri "/laravel/.env"] [unique_id "auGel4FXiz43KGy1EJXLKwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
neckaralb-admin.de
2026-10-23 05:33:10
(1 week ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
nyt
2026-10-21 23:03:35
(1 week ago)
WP User Enumeration, WP login POST blocked by WAF
Brute-Force
Web App Attack
🇳🇴
jad-abuse
2026-10-18 20:14:37
(1 week ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe, git_exposure, source_backup. Observed by 1 sensor(s); 5 hits.
Web App Attack
🇵🇱
Budyn
2026-10-17 17:25:51
(2 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: umami.budyn.wtf | URI: /.env | UA: Mozilla/5.0 (W ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: umami.budyn.wtf | URI: /.env | UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 11:33:51
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 185.238.231.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 07:33:16.246196 2026] [security2:error] [pid 3210:tid 3210] [client 185.238.231.168:22587] ...
show more
(mod_security) mod_security (id:210492) triggered by 185.238.231.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 07:33:16.246196 2026] [security2:error] [pid 3210:tid 3210] [client 185.238.231.168:22587] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.l3l4.com"] [uri "/sites/all/libraries/mailchimp/.env"] [unique_id "as9ofCKSSTJtAoV4RdkHWQAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 08:02:49
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 185.238.231.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 04:02:42.437681 2026] [security2:error] [pid 23489:tid 23489] [client 185.238.231.168:4998 ...
show more
(mod_security) mod_security (id:210492) triggered by 185.238.231.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 04:02:42.437681 2026] [security2:error] [pid 23489:tid 23489] [client 185.238.231.168:49987] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mroxyge1.mroxygen.org"] [uri "/composer.json"] [unique_id "as83Imypn3LqjCFig53RgwAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
afleventoffice.com.au
2026-09-28 00:15:30
(1 month ago)
GET /'%22%3e%3csvg/onload%3dfetch%60//uecemm2nbnm7bfc8vtplxk6ch3nwbvznpbg33tri%5c.oastify.com%60%3e H
Web App Attack
🇦🇺
afleventoffice.com.au
2026-09-27 23:28:22
(1 month ago)
GET /v1/api/graphql?query=query%7b__typename%7d HTTP/1.1
Web App Attack
2026-09-25 08:00:44
(1 month ago)
185.238.231.168 - - [25/Sep/2026:10:00:43 +0200] "GET //wp/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
...
Brute-Force
Web App Attack
🇺🇸
SX Communications
2026-09-24 15:19:18
(1 month ago)
Blocked abusive HTTP application-layer DoS / botnet traffic from 185.238.231.168: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user ho ...
show more
Blocked abusive HTTP application-layer DoS / botnet traffic from 185.238.231.168: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host.
show less
DDoS Attack
Bad Web Bot
Exploited Host
🇫🇷
dynamix
2026-09-09 02:19:32
(1 month ago)
WordPress wp-login.php Brute Force Attack
Brute-Force
Web App Attack
🇺🇦
URAN Publishing Service
2026-08-24 09:46:01
(2 months ago)
[24/Aug/2026:12:46:01 +0300] -- 185.238.231.168 Ban reason: User-Agent Go-http-client
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-08-15 07:06:48
(2 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
