🇧🇷
ICS Labs
2026-11-11 17:16:44
UTC ·
(2 days ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-11 UTC.
Brute-Force
🇩🇪
ghostwarriors
2026-11-10 20:50:24
UTC ·
(3 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-10 20:46:19
UTC ·
(3 days ago)
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0 ...
show more
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Sa
Requested, e.g.:
- apps.[REDACTED]/wp-login.php
show less
Web App Attack
🇩🇪
BlueWire Hosting
2026-11-10 12:13:21
UTC ·
(3 days ago)
Aggressive scanning resulting into 404
Bad Web Bot
🇨🇿
lp
2026-11-01 22:32:49
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 181.41.199.68
2026-11-01T23:13:23+0100 vpn Access-Reject station: 181.41.199.68
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-11-01 01:10:02
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-10-30 21:33:13
UTC ·
(2 weeks ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 181.41.199.68
2026-10-30T22:20:37+0100 vpn Access-Reject station: 181.41.199.68
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-10-30 01:10:02
UTC ·
(2 weeks ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇩🇪
LRob
2026-10-29 21:36:49
UTC ·
(2 weeks ago)
Vulnerability scanning | method: GET | path: /wp-json/wp/v2/users
Port Scan
Web App Attack
🇦🇺
paulshipley.com.au
2026-10-29 21:07:41
UTC ·
(2 weeks ago)
indigi-print-merch.com.au:443 181.41.199.68 - - [30/Oct/2026:08:07:37 +1100] "GET /?author=1&feed=rss2 HTTP/1.1" 404 324597 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
...
Web App Attack
🇸🇪
triplecode
2026-10-27 10:21:17
UTC ·
(2 weeks ago)
Reported from hMailServer
Hacking
🇺🇸
TPI-Abuse
2026-10-17 11:18:03
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 181.41.199.68 (181.41.199.68.pa.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 07:17:58.814504 2026] [security2:error] [pid 24346:tid 24346] [client ...
show more
(mod_security) mod_security (id:225170) triggered by 181.41.199.68 (181.41.199.68.pa.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 07:17:58.814504 2026] [security2:error] [pid 24346:tid 24346] [client 181.41.199.68:59545] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||robotsinme.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "robotsinme.org"] [uri "/wp-json/wp/v2/users"] [unique_id "atNZZivLGEW5Nci8fliqlQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 10:13:18
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 181.41.199.68 (181.41.199.68.pa.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 06:13:14.283510 2026] [security2:error] [pid 18109:tid 18109] [client ...
show more
(mod_security) mod_security (id:225170) triggered by 181.41.199.68 (181.41.199.68.pa.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 06:13:14.283510 2026] [security2:error] [pid 18109:tid 18109] [client 181.41.199.68:59893] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||localpetsitters.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "localpetsitters.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atNKOow9O5eHpOya7MNF0QAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
pavel Karpenko
2026-10-14 01:01:17
UTC ·
(4 weeks ago)
181.41.199.68 - - [14/Oct/2026:01:01:17 +0000] "GET /transfer/?code=IE&company_country=IE&counterparty_country=SE&country=IE&lang=pl&months=12&share=4552e8a404f3f8c8&view=companies HTTP/1.1" 401 641 "https://ultralir.com" "Mozilla/5.0 (Windows NT 10. ...
show more
181.41.199.68 - - [14/Oct/2026:01:01:17 +0000] "GET /transfer/?code=IE&company_country=IE&counterparty_country=SE&country=IE&lang=pl&months=12&share=4552e8a404f3f8c8&view=companies HTTP/1.1" 401 641 "https://ultralir.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" client_port=52125 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr=85.137.24.2 epoch=1791939677.124 visitor_cookie=0
show less
DDoS Attack
🇳🇱
DrLex0
2026-08-14 02:43:57
UTC ·
(2 months ago)
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives
181.41.199.68 443 - [14/Aug/2026:02:43:57 +0000] "GET [redacted] HTTP/1.1" 503 6189 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_ ...
show more
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives
181.41.199.68 443 - [14/Aug/2026:02:43:57 +0000] "GET [redacted] HTTP/1.1" 503 6189 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36"
show less
Bad Web Bot
Exploited Host
