|
๐บ๐ธ
mw
|
|
GET /wp-admin/shell20211028.php HTTP/1.1
|
Web App Attack
|
|
Anonymous
|
|
IP matched detection query 20 more in short time bad rqs.
|
Brute-Force
Web App Attack
Hacking
|
|
Anonymous
|
|
136.144.42.29 - - [20/Oct/2026:09:43:49 +0800] "GET /hehehehe.php HTTP/1.1" 404 16 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0"
136.144.42.29 - - [20/Oct/2026:09:43:49 +0800] "GET /.well-known/acme-challeng ...
show more
136.144.42.29 - - [20/Oct/2026:09:43:49 +0800] "GET /hehehehe.php HTTP/1.1" 404 16 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0"
136.144.42.29 - - [20/Oct/2026:09:43:49 +0800] "GET /.well-known/acme-challenge/install.php HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0"
136.144.42.29 - - [20/Oct/2026:09:43:49 +0800] "GET /.well-known/acme-challenge/plugins.php HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
136.144.42.29 - - [20/Oct/2026:09:43:50 +0800] "GET /.well-known/acme-challenge/license.php HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3"
136.144.42.29 - - [20/Oct/2026:09:43:50 +0800] "GET /wp-content/themes/astra/inc/ki1k.php HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K
...
show less
|
Bad Web Bot
Web App Attack
|
|
๐ฉ๐ช
FeG Deutschland
|
|
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
|
Exploited Host
Web App Attack
|
|
๐บ๐ธ
lostswordfish.com
|
|
Wordfence waf block on madesimpleskincare
|
Web App Attack
|
|
๐ฉ๐ช
DocNetzwerk
|
|
(wordpress) Failed wordpress login from 136.144.42.29 (US/United States/-)
|
Brute-Force
|
|
๐ฉ๐ช
FeG Deutschland
|
|
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
|
Exploited Host
Web App Attack
|
|
๐ณ๐ฑ
homeshowdomain.nl
|
|
Auto-ban: >3000 req/min op 2026-09-16
|
Web App Attack
SSH
Hacking
|
|
๐ฎ๐น
CoreTech srl
|
|
cloudlinux2 fail2ban: 2026-09-16 20:29:08,910 fail2ban.filter [1818]: INFO [plesk-modsecurity] Found 16.144.157.69 - 2026-09-16 20:29:08cloudlinux2 fail2ban: 2026-09-16 20:29:08,898 fail2ban.filter [1818]: INFO [plesk-modsecurit ...
show more
cloudlinux2 fail2ban: 2026-09-16 20:29:08,910 fail2ban.filter [1818]: INFO [plesk-modsecurity] Found 16.144.157.69 - 2026-09-16 20:29:08cloudlinux2 fail2ban: 2026-09-16 20:29:08,898 fail2ban.filter [1818]: INFO [plesk-modsecurity] Found 16.144.157.69 - 2026-09-16 20:29:08cloudlinux2 fail2ban: 2026-09-16 20:29:11,727 fail2ban.actions [1818]: NOTICE [plesk-modsecurity] Ban 16.144.157.69cloudlinux2 fail2ban: 2026-09-16 20:29:11,722 fail2ban.filter [1818]: INFO [plesk-modsecurity] Found 16.144.157.69 - 2026-09-16 20:29:11cloudlinux2 fail2ban: 2026-09-16 20:29:11,912 fail2ban.filter [1818]: INFO [recidive] Found 16.144.157.69 - 2026-09-16 20:29:11cloudlinux2 fail2ban: 2026-09-16 20:29:11,624 fail2ban.filter [1818]: INFO [plesk-modsecurity] Found 16.144.157.69 - 2026-09-16 20:29:11cloudlinux2 fail2ban: 2026-09-16 20:29:26,690 fail2ban.filter [1818]: INFO [plesk-wordpress] Found 136.144.42.29 - 2026-09-16 20:29:26cloudlinux2 fail2ban: 2026-09-
show less
|
Web App Attack
|
|
๐ฉ๐ช
schuh
|
|
25-08-2026:07:51:43UTC [Caddy] Suspicious web request: uri:/backend/.env (1 request) tcp:80
|
Bad Web Bot
Web App Attack
|
|
๐บ๐ธ
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 136.144.42.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 17:04:34.313889 2026] [security2:error] [pid 5149:tid 5149] [client 136.144.42.29:27651] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 136.144.42.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 17:04:34.313889 2026] [security2:error] [pid 5149:tid 5149] [client 136.144.42.29:27651] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.87"] [uri "/library/.env"] [unique_id "aoyx4oRYFLynsvvM4jW9NQAAAAI"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
๐ซ๐ฎ
geot
|
|
GET /new/.env HTTP/1.1
|
Hacking
Web App Attack
|
|
๐บ๐ธ
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 136.144.42.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 19:02:24.039598 2026] [security2:error] [pid 16774:tid 16774] [client 136.144.42.29:28953] M ...
show more
(mod_security) mod_security (id:210492) triggered by 136.144.42.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 19:02:24.039598 2026] [security2:error] [pid 16774:tid 16774] [client 136.144.42.29:28953] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.27"] [uri "/newsite/.env"] [unique_id "aojZAJLeEfZIE_A18KKtggAAAAI"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
๐ซ๐ท
Security_Whaller
|
|
Malicious activity detected on Honeypot.
|
Brute-Force
Hacking
Web App Attack
|
|
๐บ๐ธ
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 136.144.42.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 17:42:42.006637 2026] [security2:error] [pid 21211:tid 21211] [client 136.144.42.29:48737] M ...
show more
(mod_security) mod_security (id:210492) triggered by 136.144.42.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 17:42:42.006637 2026] [security2:error] [pid 21211:tid 21211] [client 136.144.42.29:48737] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.184"] [uri "/.env"] [unique_id "aojGUlDKJoR60wCzoETf-QAAAA4"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|