🇬🇧
consul.to
2026-11-08 23:45:21
UTC ·
(3 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
ipblock.com
2026-11-08 20:42:00
UTC ·
(6 hours ago)
IPBlock protected site ID [1438-do].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-11-08 20:28:11
UTC ·
(6 hours ago)
Web vulnerability scanning / probing from 149.104.79.86: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 2 hits; paths: /wp-json/batch, /wp-json/batch/v1.
Port Scan
Hacking
Web App Attack
🇺🇸
factor1
2026-11-08 17:08:41
UTC ·
(9 hours ago)
CrowdSec at sherman Reports Abuse
Web App Attack
🇸🇪
vaia.cloud
2026-11-08 14:45:01
UTC ·
(12 hours ago)
crowdsecurity/http-cve-probing
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 13:24:44
UTC ·
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 149.104.79.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:24:41.759977 2026] [security2:error] [pid 7682:tid 7682] [client 149.104.79.86:64122] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 149.104.79.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:24:41.759977 2026] [security2:error] [pid 7682:tid 7682] [client 149.104.79.86:64122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alphaplanning.com"] [uri "/wp-config.php"] [unique_id "avB4Gek0VVWUjaMFvOb95gAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 13:08:45
UTC ·
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 149.104.79.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:08:41.778638 2026] [security2:error] [pid 23258:tid 23258] [client 149.104.79.86:62007] M ...
show more
(mod_security) mod_security (id:210492) triggered by 149.104.79.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:08:41.778638 2026] [security2:error] [pid 23258:tid 23258] [client 149.104.79.86:62007] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.player-care.com"] [uri "/wp-config.php"] [unique_id "avB0WYRDEIa-Zwx1Va6XVQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-11-08 12:51:53
UTC ·
(13 hours ago)
Web vulnerability scanning / probing from 149.104.79.86: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 237 hits; paths: /chosen.php?p=, /db.php?u, /js.php?get, /loader/ff.php?pass=shell, ...
show more
Web vulnerability scanning / probing from 149.104.79.86: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 237 hits; paths: /chosen.php?p=, /db.php?u, /js.php?get, /loader/ff.php?pass=shell, /radio.php?pass=shell.
show less
Port Scan
Hacking
Web App Attack
🇺🇸
SX Communications
2026-11-08 12:51:53
UTC ·
(13 hours ago)
HTTP application-layer DoS / botnet traffic from 149.104.79.86: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-08 12:47:42
UTC ·
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 149.104.79.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 07:47:37.520108 2026] [security2:error] [pid 4350:tid 4350] [client 149.104.79.86:65340] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 149.104.79.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 07:47:37.520108 2026] [security2:error] [pid 4350:tid 4350] [client 149.104.79.86:65340] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.catholicshopper.com"] [uri "/wp-config.php"] [unique_id "avBvaX-vgcSUEK_VQFNxaQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 11:10:43
UTC ·
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 149.104.79.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 06:10:40.208858 2026] [security2:error] [pid 26289:tid 26289] [client 149.104.79.86:57686] M ...
show more
(mod_security) mod_security (id:210492) triggered by 149.104.79.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 06:10:40.208858 2026] [security2:error] [pid 26289:tid 26289] [client 149.104.79.86:57686] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "davidocchino.com"] [uri "/wp-config.php"] [unique_id "avBYsF45U9l7bv_M6wi5AgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 20:09:29
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 149.104.79.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 15:09:26.833700 2026] [security2:error] [pid 15350:tid 15434] [client 149.104.79.86:51354] M ...
show more
(mod_security) mod_security (id:210492) triggered by 149.104.79.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 15:09:26.833700 2026] [security2:error] [pid 15350:tid 15434] [client 149.104.79.86:51354] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.ahsdistance.org"] [uri "/wp-config.php"] [unique_id "au-Fdpjc_VerUKjp55uZagAAAJE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ipblock.com
2026-11-07 18:48:00
UTC ·
(1 day ago)
IPBlock protected site ID [4678-sl].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
🇺🇸
jormaster3k
2026-11-07 17:55:15
UTC ·
(1 day ago)
Attack against Apache (too many 404s)
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 17:45:38
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 149.104.79.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 12:45:35.085651 2026] [security2:error] [pid 32316:tid 32316] [client 149.104.79.86:59278] M ...
show more
(mod_security) mod_security (id:210492) triggered by 149.104.79.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 12:45:35.085651 2026] [security2:error] [pid 32316:tid 32316] [client 149.104.79.86:59278] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.pinballhistory.com"] [uri "/wp-config.php"] [unique_id "au9jv54nnI0IZkGHOOEXwgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
