🇺🇸
COMPLEX
2025-11-05 00:56:20
(8 months ago)
Triggered Cloudflare WAF (firewallCustom) from RU.
Action taken: BLOCK
ASN: 31133 (MF-MGSM-AS PJSC M ...
show more
Triggered Cloudflare WAF (firewallCustom) from RU.
Action taken: BLOCK
ASN: 31133 (MF-MGSM-AS PJSC MegaFon)
Protocol: HTTP/1.1 (GET method)
Endpoint: /options-reading.php
show less
Bad Web Bot
🇭🇺
bcsaba
2025-11-03 08:21:58
(8 months ago)
Looking for tiny.php
178.178.118.62 - - [03/Nov/2025:09:21:54 +0100] "GET /tiny.php HTTP/1.1" 400 63 ...
show more
Looking for tiny.php
178.178.118.62 - - [03/Nov/2025:09:21:54 +0100] "GET /tiny.php HTTP/1.1" 400 632 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
show less
Web App Attack
🇳🇱
Site.eu
2025-11-02 07:01:13
(9 months ago)
Excessive multi-domain requests
Brute-Force
🇬🇧
openstrike.co.uk
2025-11-02 06:13:09
(9 months ago)
8 attacks on PHP URLs:
GET /options-reading.php HTTP/1.1
Web App Attack
🇮🇹
Progetto1
2025-11-02 04:50:04
(9 months ago)
Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇩🇪
Stefan Dreher
2025-10-31 13:49:21
(9 months ago)
178.178.118.62 - - [31/Oct/2025:14:49:20 +0100] "GET /admin.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 ( ...
show more
178.178.118.62 - - [31/Oct/2025:14:49:20 +0100] "GET /admin.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
178.178.118.62 - - [31/Oct/2025:14:49:20 +0100] "GET /xleet.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
178.178.118.62 - - [31/Oct/2025:14:49:20 +0100] "GET /admin-header.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
178.178.118.62 - - [31/Oct/2025:14:49:20 +0100] "GET /wso.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
178.178.118.62 - - [31/Oct/2025:14:49:20 +0100] "GET /shell.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
...
show less
Hacking
Brute-Force
2025-10-29 19:53:57
(9 months ago)
wordpress-trap
Web App Attack
🇳🇱
JCB
2025-10-29 19:16:00
(9 months ago)
178.178.118.62 - - [29/Oct/2025:14:05:29 +0200] "GET /manager/media/script/mootools/mootools.js HTTP ...
show more
178.178.118.62 - - [29/Oct/2025:14:05:29 +0200] "GET /manager/media/script/mootools/mootools.js HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
show less
Web App Attack
2025-10-27 07:36:30
(9 months ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-26 00:58:54
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 178.178.118.62 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 178.178.118.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 25 20:58:47.432362 2025] [security2:error] [pid 11947:tid 11947] [client 178.178.118.62:60700] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fattoria-rendena.it|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fattoria-rendena.it"] [uri "/wp-json/wp/v2/users"] [unique_id "aP1yR_UgRX5hn3qSwvNxPwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-25 19:19:22
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 178.178.118.62 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 178.178.118.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 25 15:19:14.143584 2025] [security2:error] [pid 25135:tid 25135] [client 178.178.118.62:52362] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fusionrep.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fusionrep.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aP0isvSj18hG10MpEfM4aQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-25 18:08:27
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 178.178.118.62 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 178.178.118.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 25 14:08:22.710159 2025] [security2:error] [pid 32338:tid 32338] [client 178.178.118.62:56794] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||babylontravelone.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "babylontravelone.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aP0SFkRKPKnqusxDbWdf9QAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-25 12:34:15
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 178.178.118.62 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 178.178.118.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 25 08:34:09.149665 2025] [security2:error] [pid 13209:tid 13209] [client 178.178.118.62:60996] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||protection4allsecurity.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "protection4allsecurity.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aPzDwbqTENrMgl64Q26WAQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2025-10-24 20:50:06
(9 months ago)
WAF: Interaction with fake plugin 2- alpha
Email Spam
Brute-Force
2025-10-24 19:46:55
(9 months ago)
fail2ban apache-modsecurity web [msg "php scripts are not allowed here"] [uri "/tinyfilemanager/tiny ...
show more
fail2ban apache-modsecurity web [msg "php scripts are not allowed here"] [uri "/tinyfilemanager/tinyfilemanager.php"]
show less
Web App Attack