🇩🇪
Flatroy
2026-07-24 16:47:22
(8 hours ago)
Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto ...
show more
Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban.
show less
Web App Attack
Hacking
🇺🇸
Vianpyro
2026-07-24 15:31:29
(9 hours ago)
Honeypot: 6 request(s) in 0 min. Paths: /config.json, /.env.dev, /.env.docker. Method(s): GET. UA: M ...
show more
Honeypot: 6 request(s) in 0 min. Paths: /config.json, /.env.dev, /.env.docker. Method(s): GET. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). ASN: 51167 (Contabo GmbH).
show less
Web App Attack
Bad Web Bot
Hacking
🇺🇸
TPI-Abuse
2026-07-05 03:37:06
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 04 23:37:00.188602 2026] [security2:error] [pid 29395:tid 29395] [client 144.91.121.61:60754] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fromthehandofgodministry.org"] [uri "/wp-config.php.old"] [unique_id "aknRXPBUf7mhv6eox7qDhgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-03 02:28:25
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 22:28:17.608659 2026] [security2:error] [pid 12841:tid 12841] [client 144.91.121.61:57784] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||dwipapuri-abadi.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dwipapuri-abadi.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akceQYGB6-nCEPxNNt3DlgAAADA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-03 00:58:19
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 20:58:16.597883 2026] [security2:error] [pid 9176:tid 9176] [client 144.91.121.61:38812] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||polarisled.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "polarisled.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akcJKD-R0tlTmRplk8kwTAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ArturShelby
2026-07-02 21:05:00
(3 weeks ago)
Honeypot triggered: /wp-json/wp/v2/users/
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 20:00:27
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 16:00:20.595957 2026] [security2:error] [pid 25721:tid 25721] [client 144.91.121.61:40504] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||delstarr.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "delstarr.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbDVEYnKPbBcxbU9h04wQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 19:27:28
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 15:27:21.398578 2026] [security2:error] [pid 15768:tid 15768] [client 144.91.121.61:43108] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||wethepeoplealliance.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "wethepeoplealliance.org"] [uri "/wp-json/wp/v2/users/"] [unique_id "aka7mdFO2T6qGFf1Fr59wAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 19:04:18
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 15:04:14.294730 2026] [security2:error] [pid 30295:tid 30295] [client 144.91.121.61:50576] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ieas.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ieas.org"] [uri "/wp-json/wp/v2/users/"] [unique_id "aka2Ltx-TILP3UuorTUi5QAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
anycast_ac
2026-07-02 18:07:41
(3 weeks ago)
[DDoS Attacker] This IP was attacking website web.xzbvc.xyz and sent 275 requests on port 443
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 17:38:49
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 144.91.121.61 (vmi329568.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 13:38:41.004293 2026] [security2:error] [pid 20056:tid 20056] [client 144.91.121.61:34472] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||savingspools.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "savingspools.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akaiIIpdoH8-RSOotUFnlgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-02 13:23:18
(3 weeks ago)
2026-07-02T15:23:17.398396+02:00 soli-gate postfix/submission/smtpd[35122]: warning: vmi329568.conta ...
show more
2026-07-02T15:23:17.398396+02:00 soli-gate postfix/submission/smtpd[35122]: warning: vmi329568.contaboserver.net[144.91.121.61]: SASL CRAM-MD5 authentication failed: authentication failure, [email protected]
...
show less
Brute-Force
🇷🇺
DZBOT
2026-07-01 19:54:37
(3 weeks ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇦🇺
oncord
2026-07-01 00:54:34
(3 weeks ago)
Form spam
Web Spam
🇬🇧
killian7603
2026-06-30 20:00:04
(3 weeks ago)
Logon Policy Violation
Email Spam
Spoofing
Brute-Force