2026-11-13 06:19:29
UTC ·
(1 day ago)
172.71.164.96 - - [13/Nov/2026:06:19:29 +0000] "GET /wp-admin/install.php?step=1 HTTP/2.0" 404 918 "-" "http://ashleybutcher.org/wp-admin/install.php?step=1"
...
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 00:32:44
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:32:37.406285 2026] [security2:error] [pid 8803:tid 8803] [client 172.71.164.96:14175] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:32:37.406285 2026] [security2:error] [pid 8803:tid 8803] [client 172.71.164.96:14175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "premaindustrial.com"] [uri "/.htaccess"] [unique_id "avZapZvqk91yzI4u69qh2QAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-11 06:54:20
UTC ·
(3 days ago)
172.71.164.96 - - [11/Nov/2026:06:54:19 +0000] "GET /wp-admin/install.php?step=1 HTTP/1.1" 302 539 "-" "http://ashleybutcher.org/wp-admin/install.php?step=1"
...
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 01:20:49
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:20:45.373345 2026] [security2:error] [pid 6774:tid 6774] [client 172.71.164.96:12284] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:20:45.373345 2026] [security2:error] [pid 6774:tid 6774] [client 172.71.164.96:12284] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dabovalbb.com"] [uri "/wp-config.php"] [unique_id "avPC7SQGtS8hXf5NqcxPUAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
penjaga BRIN
2026-11-10 10:56:23
UTC ·
(4 days ago)
Suspicious malicious activity
Hacking
🇸🇪
KIDOS
2026-11-10 09:16:00
UTC ·
(4 days ago)
IIS malicious activity: high_400_error_rate (100% of requests are 400 errors)
Web App Attack
2026-11-10 09:11:28
UTC ·
(4 days ago)
fail2ban:piguard2:18,19,21
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 08:38:12
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:38:09.303383 2026] [security2:error] [pid 21097:tid 21097] [client 172.71.164.96:10091] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:38:09.303383 2026] [security2:error] [pid 21097:tid 21097] [client 172.71.164.96:10091] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.innovacionesnimba.com"] [uri "/wp-config.php"] [unique_id "avLX8af9KtNoKlS1qP9JEQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 06:49:14
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 01:49:04.443135 2026] [security2:error] [pid 7362:tid 7362] [client 172.71.164.96:13997] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 01:49:04.443135 2026] [security2:error] [pid 7362:tid 7362] [client 172.71.164.96:13997] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "starcrestsales.com"] [uri "/wp-config.php.save"] [unique_id "avK-YHipPTgwQQ5nkpYITQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 04:46:03
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 23:45:50.144080 2026] [security2:error] [pid 12661:tid 12661] [client 172.71.164.96:10636] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 23:45:50.144080 2026] [security2:error] [pid 12661:tid 12661] [client 172.71.164.96:10636] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aavondalervstorage.com"] [uri "/wp-config.php.save"] [unique_id "avKhfoSODIyY1ATUmK9N1gAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-09 23:44:02
UTC ·
(4 days ago)
172.71.164.96 - - [09/Nov/2026:23:44:01 +0000] "GET /wp-admin/install.php?step=1 HTTP/1.1" 302 539 "-" "http://ashleybutcher.org/wp-admin/install.php?step=1"
...
Bad Web Bot
Web App Attack
2026-11-08 02:17:32
UTC ·
(6 days ago)
172.71.164.96 - - [08/Nov/2026:02:17:32 +0000] "GET /wp-admin/install.php?step=1 HTTP/2.0" 404 918 "-" "http://ashleybutcher.org/wp-admin/install.php?step=1"
...
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-07 23:00:57
UTC ·
(6 days ago)
Auto-ban: >3000 req/min op 2026-11-07
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-11-07 01:37:58
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 20:37:49.347496 2026] [security2:error] [pid 15033:tid 15033] [client 172.71.164.96:13323] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 20:37:49.347496 2026] [security2:error] [pid 15033:tid 15033] [client 172.71.164.96:13323] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.teleplussolutions.com"] [uri "/.env"] [unique_id "au6A7d3U7nU76jkxDSnjNgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-06 17:59:41
UTC ·
(1 week ago)
172.71.164.96 - - [06/Nov/2026:17:59:40 +0000] "GET /wp-admin/install.php?step=1 HTTP/1.1" 302 539 "-" "http://ashleybutcher.org/wp-admin/install.php?step=1"
...
Bad Web Bot
Web App Attack
