🇩🇪
4server
2026-08-23 19:54:05
(22 hours ago)
[SunAug2321:54:03.3605542026][security2:error][pid54196:tid54215][client104.207.52.199:0]ModSecurity ...
show more
[SunAug2321:54:03.3605542026][security2:error][pid54196:tid54215][client104.207.52.199:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"ksmstudio.ch\"][uri\"/xmlrpc.php\"][unique_id\"aotP2zKrA4F_OX0A4dgcGwAAAAI\"]\,referer:https://www.facebook.com/
show less
Port Scan
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-08-21 20:25:05
(2 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇦🇺
HJ5Ss4Ju
2026-08-21 19:10:39
(2 days ago)
Blocked by Wordfence (SID 6)
Web App Attack
🇫🇷
Sklurk
2026-08-08 00:22:32
(2 weeks ago)
Web App Attack
Web App Attack
🇩🇪
MusicLibrary
2026-07-11 00:09:39
(1 month ago)
Attempted access to non existent wordpress urls
Bad Web Bot
🇨🇭
backslash
2026-07-09 02:36:00
(1 month ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇩🇪
gadix
2026-07-08 09:21:11
(1 month ago)
104.207.52.199 - - [08/Jul/2026:11:21:09 +0200] "POST /wp-login.php HTTP/1.1" 200 13181 "https://pro ...
show more
104.207.52.199 - - [08/Jul/2026:11:21:09 +0200] "POST /wp-login.php HTTP/1.1" 200 13181 "https://protec-polen-stahlbau.de/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0"
104.207.52.199 - - [08/Jul/2026:11:21:10 +0200] "POST /wp-login.php HTTP/1.1" 200 13181 "https://protec-polen-stahlbau.de/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0"
104.207.52.199 - - [08/Jul/2026:11:21:11 +0200] "POST /wp-logi
...
show less
Web App Attack
🇦🇺
RedBear IT
2026-03-26 10:00:37
(4 months ago)
"DDoS against public endpoint"
DDoS Attack
🇺🇸
TPI-Abuse
2025-11-26 21:44:19
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 16:44:14.991817 2025] [security2:error] [pid 10373:tid 10373] [client 104.207.52.199:25857] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.londonconsulting.info"] [uri "/.env"] [unique_id "aSd0rgWsI86UF_XnEL48OgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 17:52:53
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 12:52:47.581100 2025] [security2:error] [pid 5077:tid 5077] [client 104.207.52.199:47947] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "test.grimone.com"] [uri "/.git/HEAD"] [unique_id "aSc-b7eWh5bdFvUOg0Mq9QAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 09:43:55
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 04:43:49.220733 2025] [security2:error] [pid 24633:tid 24633] [client 104.207.52.199:9123] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.madronabluff.com"] [uri "/.env"] [unique_id "aSbL1RDrQg5i6mHdYlTLhgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 05:50:55
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:50:48.964081 2025] [security2:error] [pid 1249:tid 1249] [client 104.207.52.199:37797] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.lanzadesign.com"] [uri "/.env"] [unique_id "aSVDuN4CaBgpY7H0hJ6MQwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 05:19:35
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:19:30.899950 2025] [security2:error] [pid 22863:tid 22863] [client 104.207.52.199:20635] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "therocklink.ramoundos.com"] [uri "/.git/HEAD"] [unique_id "aSU8Yjk7MPTG8tp9-Y1hwgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 05:00:25
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:00:11.306952 2025] [security2:error] [pid 1817001:tid 1817063] [client 104.207.52.199:25991] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.windhamphoto.com"] [uri "/.env"] [unique_id "aSU322R1ttxeyDpsCa9ilQAAAZg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 04:03:08
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.52.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:03:01.595928 2025] [security2:error] [pid 763607:tid 763607] [client 104.207.52.199:30483] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.jbcllcnet.com"] [uri "/.env"] [unique_id "aSUqdVEd3jhn3N-ZikMFWQAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack