🇬🇧
openstrike.co.uk
2026-11-14 06:17:09
UTC ·
(1 hour ago)
3 attacks on PHP URLs, Alfa URLs:
POST /wp-plain.php HTTP/1.1
POST /alfacgiapi/perl.alfa HTTP/1.1
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-14 05:17:55
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210350) triggered by 158.173.74.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 00:17:47.250919 2026] [security2:error] [pid 3942:tid 3942] [client 158.173.74.96:64355] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 158.173.74.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 00:17:47.250919 2026] [security2:error] [pid 3942:tid 3942] [client 158.173.74.96:64355] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.fundingworkingcapital.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fundingworkingcapital.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "avfu-8kE46-sJY0wJ5_aQgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
jmh888
2026-11-14 04:47:48
UTC ·
(3 hours ago)
[Sat Nov 14 04:47:47.716998 2026] [php:error] [pid 1060654] [client 158.173.74.96:56401] script '/var/www/html/wp-plain.php' not found or unable to stat, referer: www.google.com
[Sat Nov 14 04:47:47.781192 2026] [php:error] [pid 1060654] [client 158. ...
show more
[Sat Nov 14 04:47:47.716998 2026] [php:error] [pid 1060654] [client 158.173.74.96:56401] script '/var/www/html/wp-plain.php' not found or unable to stat, referer: www.google.com
[Sat Nov 14 04:47:47.781192 2026] [php:error] [pid 1060654] [client 158.173.74.96:56401] script '/var/www/html/vkwawpny.php' not found or unable to stat, referer: www.google.com
[Sat Nov 14 04:47:47.982840 2026] [php:error] [pid 1058907] [client 158.173.74.96:28425] script '/var/www/html/wp-plain.php' not found or unable to stat, referer: www.google.com
...
show less
Web App Attack
🇬🇷
setupgr
2026-11-14 04:04:52
UTC ·
(4 hours ago)
(mod_security) mod_security (id:1000001) triggered by 158.173.74.96 (DK/Denmark/Capital Region/Copenhagen/-/[AS42708 Glesys Sweden AB]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Nov 14 06:04:48. ...
show more
(mod_security) mod_security (id:1000001) triggered by 158.173.74.96 (DK/Denmark/Capital Region/Copenhagen/-/[AS42708 Glesys Sweden AB]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Nov 14 06:04:48.111733 2026] [security2:error] [pid 2604288:tid 2604394] [client 158.173.74.96:62725] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/db.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "102"] [id "1000001"] [msg "Bad file blocked: /wp-content/themes/seotheme/db.php"] [severity "CRITICAL"] [tag "security"] [hostname "ftiaxtomonosou.gr"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "avfd4LFTqYA3h4z4uFtpPwAABAA"], referer: www.google.com
show less
Port Scan
🇩🇪
maxpower
2026-11-14 03:27:14
UTC ·
(4 hours ago)
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 158.173.74.96 (DK/Denmark/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 158.173.74.96 - - [14/Nov/2026:04:27:09 +0100] "GET /wp-content/themes/seotheme/db.ph ...
show more
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 158.173.74.96 (DK/Denmark/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 158.173.74.96 - - [14/Nov/2026:04:27:09 +0100] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 200 12108 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "-" host=frleone.ovh
show less
Port Scan
🇩🇪
SCHAPPY
2026-11-14 03:04:24
UTC ·
(5 hours ago)
Mutliple attempts to access forbidden web resources, HTTP code 403.
Web App Attack
🇩🇪
SCHAPPY
2026-11-14 02:36:36
UTC ·
(5 hours ago)
Faked HTTP referer / referer spam detected.
Blog Spam
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 02:02:22
UTC ·
(6 hours ago)
(mod_security) mod_security (id:210350) triggered by 158.173.74.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 21:02:16.331198 2026] [security2:error] [pid 28319:tid 28319] [client 158.173.74.96:20651] M ...
show more
(mod_security) mod_security (id:210350) triggered by 158.173.74.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 21:02:16.331198 2026] [security2:error] [pid 28319:tid 28319] [client 158.173.74.96:20651] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.fredlandia.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fredlandia.com"] [uri "/wp-content/plugins/apikey/apikey.php"] [unique_id "avfBKK2c30gCkKP9jNPaNgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
andypiper
2026-11-14 02:01:19
UTC ·
(6 hours ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇩🇪
maxpower
2026-11-14 01:58:17
UTC ·
(6 hours ago)
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 158.173.74.96 (DK/Denmark/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 158.173.74.96 - - [14/Nov/2026:02:58:11 +0100] "GET /wp-content/themes/seotheme/db.ph ...
show more
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 158.173.74.96 (DK/Denmark/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 158.173.74.96 - - [14/Nov/2026:02:58:11 +0100] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 200 12049 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "-" host=freddiegroup.com
show less
Port Scan
🇩🇪
maxpower
2026-11-14 01:13:24
UTC ·
(6 hours ago)
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 158.173.74.96 (DK/Denmark/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 158.173.74.96 - - [14/Nov/2026:02:13:21 +0100] "GET /wp-content/themes/seotheme/db.ph ...
show more
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 158.173.74.96 (DK/Denmark/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 158.173.74.96 - - [14/Nov/2026:02:13:21 +0100] "GET /wp-content/themes/seotheme/db.php?u HTTP/2.0" 200 4737 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "158.173.74.96" host=francescadandrea.com
show less
Port Scan
🇫🇷
masterguru
2026-11-13 23:54:55
UTC ·
(8 hours ago)
BAD BOT - Detected and Blocked.. Matched phrase "mozlila" at REQUEST_HEADERS:User-Agent. (1100000-135)
Bad Web Bot
🇳🇱
e.fierstra
2026-11-13 23:16:48
UTC ·
(8 hours ago)
excessive HTTP 404 errors
Bad Web Bot
🇫🇷
SpaceHost-Server
2026-11-13 23:15:55
UTC ·
(8 hours ago)
Brute-Force
Web App Attack
🇺🇸
Major Hostility
2026-11-13 22:45:05
UTC ·
(9 hours ago)
"POST /wp-plain.php HTTP/1.1" 404
"POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1" 404
"POST /alfacgiapi/perl.alfa HTTP/1.1" 404
Web App Attack
