🇫🇮
YF
2026-10-23 09:30:56
(1 day ago)
WordPress config file probe
Web App Attack
🇩🇪
altenglaner
2026-10-23 09:04:59
(1 day ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇺🇸
Major Hostility
2026-10-23 08:57:06
(1 day ago)
"GET /wp-config.php.backup HTTP/1.1" 404
"GET /wp-config.php~ HTTP/1.1" 404
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 06:24:01
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 138.99.37.166 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 138.99.37.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 02:23:54.781984 2026] [security2:error] [pid 22512:tid 22512] [client 138.99.37.166:55922] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "americanacademyofteachersofsinging.org"] [uri "/wp-config.php.backup"] [unique_id "atr9eon2UvKQb8J_cRiXEwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
netclix.gr
2026-10-23 06:23:08
(1 day ago)
(modsec_403) ModSecurity 403 Access Denied 138.99.37.166 (CA/Canada/-)
Hacking
🇩🇪
LRob
2026-10-23 04:27:17
(1 day ago)
Secret file probe | method: GET | path: /wp-config.php.backup | ua: Mozilla/5.0 (Windows NT 10.0; Wi ...
show more
Secret file probe | method: GET | path: /wp-config.php.backup | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 | src_port: 33934
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 22:20:29
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 138.99.37.166 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 138.99.37.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 18:20:25.702707 2026] [security2:error] [pid 881:tid 881] [client 138.99.37.166:35931] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "anthonyanimalclinic.net"] [uri "/wp-config.php.backup"] [unique_id "atqMKc2JhxTiw4UIgpE3fAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 19:57:17
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 138.99.37.166 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 138.99.37.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 15:57:12.534788 2026] [security2:error] [pid 1004:tid 1004] [client 138.99.37.166:38496] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "amlanddgtours.com"] [uri "/wp-config.php.backup"] [unique_id "atpqmJa_8y9nOTFEs5KWcQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 18:23:56
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 138.99.37.166 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 138.99.37.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 14:23:48.563746 2026] [security2:error] [pid 15941:tid 15941] [client 138.99.37.166:50731] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||alpinexport.com|F|2"] [data ".php.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "alpinexport.com"] [uri "/wp-config.php.backup"] [unique_id "atpUtCo2Bv4KzEQ-jT1OgAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-10-22 14:35:26
(1 day ago)
[ThuOct2216:35:21.9721842026][security2:error][pid476333:tid476392][client138.99.37.166:0]ModSecurit ...
show more
[ThuOct2216:35:21.9721842026][security2:error][pid476333:tid476392][client138.99.37.166:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\"wp-config\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"710\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"annunci-ticino.ch\"][uri\"/wp-config.php.backup\"][unique_id\"atofKStwU85oEt6_BBnO7QAAAE4\"]
show less
Hacking
Web App Attack
2025-05-26 03:55:21
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-05-24 02:15:46
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-05-20 14:58:35
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇬🇧
oncord
2025-05-20 04:13:18
(1 year ago)
Form spam
Web Spam
2025-05-16 09:32:23
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
