🇬🇧
openstrike.co.uk
2026-11-13 06:14:39
UTC ·
(1 day ago)
12 attacks on Wordpress URLs, PHP URLs:
GET /sito/wp-includes/wlwmanifest.xml HTTP/1.1
GET /xmlrpc.php?rsd HTTP/1.1
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 01:18:26
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 20:18:20.374730 2026] [security2:error] [pid 21970:tid 21970] [client 172.70.240.12:11000] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 20:18:20.374730 2026] [security2:error] [pid 21970:tid 21970] [client 172.70.240.12:11000] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.reachpoint.com"] [uri "/wp-config.php.bak"] [unique_id "avZlXEM03Z87Ce0JZUPbYwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-11-11 12:30:47
UTC ·
(3 days ago)
Automated honeypot detection. blocked ip against a Next.js application. Paths: /wp-admin/install.php?step=1. Blocked at the edge.
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-11 02:01:34
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 21:01:28.828812 2026] [security2:error] [pid 2497:tid 2497] [client 172.70.240.12:11999] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 21:01:28.828812 2026] [security2:error] [pid 2497:tid 2497] [client 172.70.240.12:11999] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.kayelynn.com"] [uri "/wp-config.php.old"] [unique_id "avPMeKVaDUQdtrO1fSt9EwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
david.houstin
2026-11-11 00:36:30
UTC ·
(4 days ago)
172.70.240.12 - - [11/Nov/2026:01:36:23 +0100] "GET /wp-config.php.bak HTTP/2.0" 404 315 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15"
172.70.240.12 - - [11/Nov/2026:01:36: ...
show more
172.70.240.12 - - [11/Nov/2026:01:36:23 +0100] "GET /wp-config.php.bak HTTP/2.0" 404 315 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15"
172.70.240.12 - - [11/Nov/2026:01:36:23 +0100] "GET /config.json HTTP/2.0" 404 315 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
172.70.240.12 - - [11/Nov/2026:01:36:23 +0100] "GET /config.yml HTTP/2.0" 404 264 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
172.70.240.12 - - [11/Nov/2026:01:36:23 +0100] "GET /index.php.bak HTTP/2.0" 404 264 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
172.70.240.12 - - [11/Nov/2026:01:36:23 +0100] "GET /index.php.save HTTP/2.0" 404 264 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Ver
...
show less
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-11 00:35:52
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:35:46.146756 2026] [security2:error] [pid 875:tid 875] [client 172.70.240.12:13126] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:35:46.146756 2026] [security2:error] [pid 875:tid 875] [client 172.70.240.12:13126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "erikageyama.com"] [uri "/wp-config.php.old"] [unique_id "avO4Yn0d0dzmMOuVnbAvBwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 12:04:05
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 07:03:57.577263 2026] [security2:error] [pid 11292:tid 11292] [client 172.70.240.12:13832] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 07:03:57.577263 2026] [security2:error] [pid 11292:tid 11292] [client 172.70.240.12:13832] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "itony.com"] [uri "/wp-config.php.bak"] [unique_id "avMILdssBhx1vIL0hCXMhQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 08:26:17
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:26:08.293207 2026] [security2:error] [pid 5176:tid 5292] [client 172.70.240.12:11581] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:26:08.293207 2026] [security2:error] [pid 5176:tid 5292] [client 172.70.240.12:11581] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.seips.org"] [uri "/wp-config.php.save"] [unique_id "avLVIHdUqbPZdiF1g8hMAQAAAhM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
Origon
2026-11-10 04:36:59
UTC ·
(4 days ago)
plesk-modsecurity - IP: 172.70.240.12 - [10/Nov/2026:05:36:59.184064 +0100] avKfa2WZH2AzVbXXMeTwdAAAAFM 172.70.240.12 45252 127.0.0.1 7081 [10/Nov/2026:05:36:59.186387 +0100] avKfa4rjiw0fQ4GcTlwGNgAAAAU 172.70.240.12 45292 127.0.0.1 7081 [10/Nov/202 ...
show more
plesk-modsecurity - IP: 172.70.240.12 - [10/Nov/2026:05:36:59.184064 +0100] avKfa2WZH2AzVbXXMeTwdAAAAFM 172.70.240.12 45252 127.0.0.1 7081 [10/Nov/2026:05:36:59.186387 +0100] avKfa4rjiw0fQ4GcTlwGNgAAAAU 172.70.240.12 45292 127.0.0.1 7081 [10/Nov/2026:05:36:59.190324 +0100] avKfa4rjiw0fQ4GcTlwGNwAAAAk 172.70.240.12 45276 127.0.0.1 7081 [10/Nov/2026:05:36:59.234360 +0100] avKfa2WZH2AzVbXXMeTwfQAAAEs 172.70.240.12 45398 127.0.0.1 7081
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 03:54:59
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:54:49.852622 2026] [security2:error] [pid 2718124:tid 2718130] [client 172.70.240.12:1198 ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:54:49.852622 2026] [security2:error] [pid 2718124:tid 2718130] [client 172.70.240.12:11986] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.alicefaye.com"] [uri "/wp-config.php"] [unique_id "avKViRuR9WA4in8SXOxz_gAAAEI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 00:55:06
UTC ·
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:55:01.161111 2026] [security2:error] [pid 27350:tid 27350] [client 172.70.240.12:13430] M ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:55:01.161111 2026] [security2:error] [pid 27350:tid 27350] [client 172.70.240.12:13430] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||susannahtuttle.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "susannahtuttle.com"] [uri "/index.php.bak"] [unique_id "avJrZdUbbgsTl0-sBn-iDAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-11-09 00:32:05
UTC ·
(6 days ago)
Automated honeypot detection. blocked ip against a Next.js application. Paths: /wp-admin/install.php?step=1. Blocked at the edge.
Bad Web Bot
🇩🇪
findlab
2026-11-07 13:15:03
UTC ·
(1 week ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-11-07 12:30:41
UTC ·
(1 week ago)
Automated honeypot detection. blocked ip against a Next.js application. Paths: /wp-admin/install.php?step=1. Blocked at the edge.
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-07 04:11:25
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 23:11:17.348140 2026] [security2:error] [pid 25070:tid 25070] [client 172.70.240.12:10194] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.240.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 23:11:17.348140 2026] [security2:error] [pid 25070:tid 25070] [client 172.70.240.12:10194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.keithgill.com"] [uri "/.env.dev"] [unique_id "au6k5YNuG8I-UmWmqA2AswAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
