🇩🇪
4server
2026-10-19 17:50:10
(3 days ago)
[MonOct1919:50:04.6536302026][security2:error][pid1411704:tid1411791][client154.219.236.202:0]ModSec ...
show more
[MonOct1919:50:04.6536302026][security2:error][pid1411704:tid1411791][client154.219.236.202:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"alessandrolucchini.ch\"][uri\"/wp-config.php.backup\"][unique_id\"atZYTMBW7mQP-3fGeXeh4wAAAMA\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-10-19 16:43:17
(3 days ago)
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 154 ...
show more
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 154.219.236.202 - - \[19/Oct/2026:18:42:55 +0200\] "GET /wp-config.php.backup HTTP/1.1" 301 459 "-" "Chrome"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-19 13:39:31
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 154.219.236.202 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 154.219.236.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 09:39:26.314764 2026] [security2:error] [pid 14349:tid 14349] [client 154.219.236.202:37879] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "airdriedrivingschool.com"] [uri "/wp-config.php.old"] [unique_id "atYdjiuxz8rVjmJsR9AenwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
maxpower
2026-10-19 09:22:28
(4 days ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 154.219.236.202 (KR/South Korea/-): 1 in ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 154.219.236.202 (KR/South Korea/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 154.219.236.202 - - [19/Oct/2026:11:22:24 +0200] "GET /wp-config.php.bak HTTP/1.1" 403 146 "-" "Chrome" "-" host=alessandradamato.com
show less
Port Scan
🇺🇸
TPI-Abuse
2026-10-18 09:03:56
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 154.219.236.202 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 154.219.236.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 05:03:49.681525 2026] [security2:error] [pid 16041:tid 16041] [client 154.219.236.202:17987] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||advantagept.org|F|2"] [data ".php.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "advantagept.org"] [uri "/configuration.php.old"] [unique_id "atSLdaeMvMC_iumTul-TKAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-18 08:21:02
(5 days ago)
Secret file probe | method: GET | path: /wp-config.php.old | ua: Chrome
Hacking
Web App Attack
🇫🇷
COMAITE
2026-10-18 05:59:00
(5 days ago)
Suspicious URL access.
Web App Attack
🇮🇹
VHosting
2026-10-18 00:10:03
(5 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
2026-10-17 13:28:07
(6 days ago)
[news.tmg.gr] httpd-config-scan: sites=aidshep2021.gr; logs=/var/log/httpd/domains/aidshep2021.gr.lo ...
show more
[news.tmg.gr] httpd-config-scan: sites=aidshep2021.gr; logs=/var/log/httpd/domains/aidshep2021.gr.log; samples=/wp-config.php~ | fast_lane=true kernel_at=2026-10-17T13:27:09+00:00 | requests=1
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 09:32:43
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 154.219.236.202 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 154.219.236.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 05:32:39.103819 2026] [security2:error] [pid 31294:tid 31294] [client 154.219.236.202:35261] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aholsniffsglue.com"] [uri "/wp-config.php.backup"] [unique_id "atNAt9u5wuZby2v7OvtTNAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 08:15:48
(1 week ago)
(mod_security) mod_security (id:949110) triggered by 154.219.236.202 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:949110) triggered by 154.219.236.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 04:15:43.431118 2026] [security2:error] [pid 23508:tid 23508] [client 154.219.236.202:63141] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "akistech.com"] [uri "/wp-config.php.backup"] [unique_id "atHdLyu4CGRr-5xMIjFTOgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack