Anonymous
2026-11-14 06:22:26
UTC ·
(1 hour ago)
🔥 Web application attack detected. Vulnerability scanning and exploitation attempts identified.
Port Scan
Web App Attack
Anonymous
2026-11-14 06:20:57
UTC ·
(1 hour ago)
107.149.152.87 - - [14/Nov/2026:14:20:38 +0800] "POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1" 404 13896 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.311 ...
show more
107.149.152.87 - - [14/Nov/2026:14:20:38 +0800] "POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1" 404 13896 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
107.149.152.87 - - [14/Nov/2026:14:20:39 +0800] "GET /wp-content/plugins/fix/up.php HTTP/1.1" 404 13895 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36"
107.149.152.87 - - [14/Nov/2026:14:20:39 +0800] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 404 13895 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
107.149.152.87 - - [14/Nov/2026:14:20:39 +0800] "POST /wp-plain.php HTTP/1.1" 404 13896 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4
...
show less
Bad Web Bot
Web App Attack
🇺🇸
koinkash.org
2026-11-14 05:50:59
UTC ·
(1 hour ago)
They are fraudulent. Malicious threat actor requesting php file /wp-content/themes/seotheme/db.php
Web App Attack
🇩🇪
maxpower
2026-11-14 05:48:49
UTC ·
(1 hour ago)
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 107.149.152.87 (BR/Brazil/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 107.149.152.87 - - [14/Nov/2026:06:48:47 +0100] "GET /wp-content/themes/seotheme/db.p ...
show more
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 107.149.152.87 (BR/Brazil/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 107.149.152.87 - - [14/Nov/2026:06:48:47 +0100] "GET /wp-content/themes/seotheme/db.php?u HTTP/2.0" 200 4736 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "107.149.152.87" host=focusabruzzo.eu
show less
Port Scan
🇫🇷
dynamix
2026-11-14 05:32:58
UTC ·
(1 hour ago)
Multiple WAF Violations
Web App Attack
🇺🇸
Starburst SysOp Team
2026-11-14 04:49:25
UTC ·
(2 hours ago)
Found User-Agent associated with security scanner. Matched phrase "Mozlila" at REQUEST_HEADERS:User-Agent. (913100-mnz6-1)
Hacking
Bad Web Bot
🇩🇪
maxpower
2026-11-14 04:47:54
UTC ·
(2 hours ago)
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 107.149.152.87 (BR/Brazil/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 107.149.152.87 - - [14/Nov/2026:05:47:50 +0100] "GET /wp-content/themes/seotheme/db.p ...
show more
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 107.149.152.87 (BR/Brazil/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 107.149.152.87 - - [14/Nov/2026:05:47:50 +0100] "GET /wp-content/themes/seotheme/db.php?u HTTP/2.0" 200 4737 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "107.149.152.87" host=notaiopanella.it
show less
Port Scan
🇺🇸
nationaleventpros.com
2026-11-14 04:13:45
UTC ·
(3 hours ago)
vulnerability scan
Web App Attack
🇺🇸
agenciahypelab.com.br
2026-11-14 03:34:33
UTC ·
(3 hours ago)
WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER
Brute-Force
SSH
🇦🇺
Proxay Fox
2026-11-14 00:57:10
UTC ·
(6 hours ago)
107.149.152.87 - - [14/Nov/2026:10:56:59 +1000] "GET /wp-content/themes/seotheme/db.php?u HTTP/2.0" 404 36 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.31 ...
show more
107.149.152.87 - - [14/Nov/2026:10:56:59 +1000] "GET /wp-content/themes/seotheme/db.php?u HTTP/2.0" 404 36 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "107.149.152.87" 454 314 TLSv1.3/TLS_AES_256_GCM_SHA384 . ef0f09427ab3b131105cd7d8e05365fd55d652963cd3bfd7e44f65bc32ad075a
107.149.152.87 - - [14/Nov/2026:10:56:59 +1000] "GET /wp-content/plugins/fix/up.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36" "107.149.152.87" 291 314 TLSv1.3/TLS_AES_256_GCM_SHA384 . 5084e640954a83ec68890c9b7da15516db61a75b3707ac410ec382654a60d9da
107.149.152.87 - - [14/Nov/2026:10:56:59 +1000] "POST /wp-plain.php HTTP/2.0" 404 36 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/5
...
show less
Brute-Force
Web App Attack
🇩🇪
svr
2026-11-14 00:45:23
UTC ·
(6 hours ago)
Abusive Automated Web Scanner
Web App Attack
🇫🇷
Tilellit.PRO
2026-11-14 00:40:41
UTC ·
(6 hours ago)
Malicious or fake user-agent string used to bypass scraping restrictions
Web App Attack
Bad Web Bot
🇺🇸
Agaman
2026-11-14 00:37:11
UTC ·
(6 hours ago)
Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-14 00:37 UTC. Samples: POST /wp-plain.php 444; POST /ALFA_DATA/alfacgiapi/perl.alfa 444; GET /wp-content/themes/seotheme/db.php 444. UA: Mozilla/5.0 (Linux; Android 7.0; SM- ...
show more
Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-14 00:37 UTC. Samples: POST /wp-plain.php 444; POST /ALFA_DATA/alfacgiapi/perl.alfa 444; GET /wp-content/themes/seotheme/db.php 444. UA: Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (. Detected by fail2ban.
show less
Web App Attack
🇩🇪
maxpower
2026-11-14 00:06:22
UTC ·
(7 hours ago)
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 107.149.152.87 (BR/Brazil/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 107.149.152.87 - - [14/Nov/2026:01:06:16 +0100] "GET /wp-content/themes/seotheme/db.p ...
show more
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 107.149.152.87 (BR/Brazil/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 107.149.152.87 - - [14/Nov/2026:01:06:16 +0100] "GET /wp-content/themes/seotheme/db.php?u HTTP/2.0" 200 4732 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "107.149.152.87" host=ctpescara.it
show less
Port Scan
🇯🇵
S.O.B.A. Dev.
2026-11-13 22:29:14
UTC ·
(9 hours ago)
Web vulnerability scanning
Brute-Force
Web Spam
Web App Attack