🇬🇷
setupgr
2026-10-17 06:10:31
(13 hours ago)
(mod_security) mod_security (id:1000001) triggered by 185.192.71.77 (GB/United Kingdom/England/Londo ...
show more
(mod_security) mod_security (id:1000001) triggered by 185.192.71.77 (GB/United Kingdom/England/London/-/[AS206092 F.n.s. Holdings Limited]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Oct 17 09:10:27.243305 2026] [security2:error] [pid 2662:tid 2861] [client 185.192.71.77:63267] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/txets.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "102"] [id "1000001"] [msg "Bad file blocked: /wp-admin/txets.php"] [severity "CRITICAL"] [tag "security"] [hostname "setworldup365.com"] [uri "/wp-admin/txets.php"] [unique_id "atMRU7EOX7S7Yc9_TLRG2wAAAdc"]
show less
Port Scan
🇩🇪
Vegascosmetics
2026-10-16 15:50:32
(1 day ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possi ...
show more
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possible exploited host). Evidence: AttackPattern: /[a-z0-9]{1,12}\.php (Match: /bless.php)
show less
Hacking
Exploited Host
Web App Attack
🇬🇧
consul.to
2026-10-16 10:43:57
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
RamSet
2026-10-08 19:35:43
(1 week ago)
[ycr] HTTP-Probe on port 443 (via domain). 33 distinct paths probed in 42s. Sustained 35 req/min, 32 ...
show more
[ycr] HTTP-Probe on port 443 (via domain). 33 distinct paths probed in 42s. Sustained 35 req/min, 32 nonexistent paths (404), scanner-tool user-agent. Paths: //wp-content/plugins/fix//wp%20sittnegc.php, //wp-content/plugins/fix/up.php, //wp-content/plugins/fix/wp.php, /000.php, /abcd.php, /bless.php, /blurbs.php, /bolt.php, /chosen.php?p=, /cord.php, /dex.php, /file.php, /gifclass.php, /goods.php, /ioxi-o.php, /lufix.php, /style.php, /txets.php, /wp-admin/admin-ajax.php, /wp-admin/css/colors/wp-login.php, /wp-admin/css/goods.php, /wp-admin/css/index.php, /wp-admin/index.php, /wp-admin/txets.php, /wp-content/goods.php, /wp-content/index.php, /wp-content/plugins/fix/000.php, /wp-content/plugins/index.php, /wp-content/themes/txets.php, /wp-editor.php, /wp-includes/hp2.php, /wp-includes/txets.php
show less
Bad Web Bot
Web App Attack
🇫🇮
as211431.net
2026-10-08 00:01:15
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from GB.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show more
Triggered Cloudflare WAF (firewallCustom) from GB.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /wp-content/themes/txets.php
UA: Go-http-client/1.1
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇳🇱
homeshowdomain.nl
2026-09-23 22:00:39
(3 weeks ago)
Auto-ban: >3000 req/min op 2026-09-23
Web App Attack
SSH
Hacking
🇳🇱
e.fierstra
2026-09-23 12:42:08
(3 weeks ago)
excessive HTTP 404 errors
Bad Web Bot
🇪🇸
librebit
2026-09-23 12:39:21
(3 weeks ago)
Brute force
Brute-Force
🇩🇪
pscriptos
2026-09-23 01:32:59
(3 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇦
URAN Publishing Service
2026-09-22 13:44:41
(3 weeks ago)
[22/Sep/2026:16:44:41 +0300] -- 185.192.71.77 Ban reason: User-Agent Go-http-client
Bad Web Bot
Web App Attack
🇬🇧
Interceptor_HQ
2026-09-22 07:58:06
(3 weeks ago)
request_uri: /000.php -- automatic report --
Brute-Force
Hacking
🇳🇱
Alt255
2026-09-21 17:33:21
(3 weeks ago)
[cb-10al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail ngin ...
show more
[cb-10al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail nginx-404. Example: 185.192.71.77 - - [21/Sep/2026:19:33:07 +0200] "GET /000.php HTTP/1.0" 404 94919 "http://reindersruitersport.nl/000.php" "Go-http-client/2.0"
185.192.71.77 - - [21/Sep/2026:19:33:08 +0200] "GET /chosen.php HTTP/1.0" 404 94922 "http://reindersruitersport.nl/chosen.php?p=" "Go-http-client/2.0"
185.192.71.77 - - [21/Sep/2026:19:33:08 +0200] "GET /wp-includes/hp2.php HTTP/1.0" 404 94932 "http://reindersruitersport.nl/wp-includes/hp2.php" "Go-http-client/2.0"
185.192.71.77 - - [21/Sep/2026:19:33:09 +0200] "GET /gifclass.php HTTP/1.0" 404 94924 "http://reindersruitersport.nl/gifclass.php#888xyz999" "Go-http-client/2.0"
185.192.71.77 - - [21/Sep/2026:19:33:09 +0200] "GET /bless.php HTTP/1.0" 404 94921 "http://reindersruitersport.nl/bless.php#888xyz999" "Go-http-client/2.0"
185.192.71.77 - - [21/S
...
show less
Bad Web Bot
Web App Attack
🇪🇸
librebit
2026-09-20 13:56:13
(3 weeks ago)
Brute force
Brute-Force
2026-09-20 13:04:30
(3 weeks ago)
Web probing (32 hits in 24h) on default-vhost: sensitive-path scans and/or 404 bursts. Reported by C ...
show more
Web probing (32 hits in 24h) on default-vhost: sensitive-path scans and/or 404 bursts. Reported by CRMON.
show less
Web App Attack
🇨🇭
zynex
2026-09-20 05:51:38
(3 weeks ago)
URL Probing: /cord.php
Web App Attack