🇬🇷
setupgr
2026-07-06 20:57:18
(1 week ago)
(wplogin_block) Blocked WP-Login Access Attempt 185.228.3.17 (PT/Portugal/Lisbon/Lisbon/-/[AS206092 ...
show more
(wplogin_block) Blocked WP-Login Access Attempt 185.228.3.17 (PT/Portugal/Lisbon/Lisbon/-/[AS206092 SECFIREWALLAS]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 185.228.3.17 - - [06/Jul/2026:23:56:30 +0300] "GET /wp-login.php HTTP/1.1" 200 3024 "-" "python-requests/2.28.2"
show less
Port Scan
🇺🇸
xserverx.ru
2026-07-06 15:21:20
(1 week ago)
Honeypot triggered:
IP: 185.228.3.17
Request to: https://horny-pot.ru/.env
Method: GET
Host: horny-p ...
show more
Honeypot triggered:
IP: 185.228.3.17
Request to: https://horny-pot.ru/.env
Method: GET
Host: horny-pot.ru
User-Agent: python-requests/2.28.2
Referer: Direct
Country: PT
ASN: Unknown
Triggered rules: (\.env|\.env\.local|\.env\.production), (python-requests|java.*httpclient)
Timestamp: 2026-07-06T15:21:20.304Z
show less
Hacking
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-04-22 19:12:01
(2 months ago)
IM360 WAF: Laravel .env file access
Web App Attack
🇺🇸
myagent.site
2026-03-28 02:38:03
(3 months ago)
Blocking for trying to access an exploit file: /files/index.php
Hacking
🇩🇪
AetherFox
2026-03-27 10:54:49
(3 months ago)
[Fri Mar 27 10:54:49.037529 2026] [authz_core:error] [pid 500189:tid 500197] [client 185.228.3.17:61 ...
show more
[Fri Mar 27 10:54:49.037529 2026] [authz_core:error] [pid 500189:tid 500197] [client 185.228.3.17:61233] AH01630: client denied by server configuration: proxy:http://5.75.191.34/wp-includes/l10n/
[Fri Mar 27 10:54:49.037699 2026] [authz_core:error] [pid 500189:tid 500197] [client 185.228.3.17:61233] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html
[Fri Mar 27 10:54:49.202925 2026] [authz_core:error] [pid 500189:tid 500226] [client 185.228.3.17:61233] AH01630: client denied by server configuration: proxy:http://5.75.191.34/wp-includes/sodium_compat/lib/
[Fri Mar 27 10:54:49.203056 2026] [authz_core:error] [pid 500189:tid 500226] [client 185.228.3.17:61233] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html
[Fri Mar 27 10:54:49.284528 2026] [authz_core:error] [pid 500189:tid 500237] [client 185.228.3.17:61233] AH01630: client denied by server configuration: proxy:http://5.75.191.34/wp-includes/blocks/file/
...
show less
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-03-27 06:42:03
(3 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
octageeks.com
2026-03-27 04:12:45
(3 months ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇳🇿
Antinson
2026-03-27 00:26:06
(3 months ago)
Scraping with a high error ratio and request rate
Bad Web Bot
🇳🇱
Site.eu
2026-03-25 10:08:03
(3 months ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
SCHAPPY
2026-03-25 07:12:51
(3 months ago)
Brute-force attack to identify web exploits
Brute-Force
Web App Attack
🇺🇸
r3versedk
2026-03-24 06:14:03
(3 months ago)
🛡️ Automated Threat Report from maxjensen.dk
🎯 Attack Type: Botnet Fingerprint
🚨 Severity: CRITICAL ...
show more
🛡️ Automated Threat Report from maxjensen.dk
🎯 Attack Type: Botnet Fingerprint
🚨 Severity: CRITICAL
📊 Threat Score: 95/100
📈 Total Attacks: 424 (database verified, seen over today)
🔍 Peak Score: 95/100
🎯 Common Types: Botnet Fingerprint(1x)
🔍 Fingerprint: 9f96b00ce11bc787
🤖 AI/ML: 🤝 Multi-Model Consensus (neural-network, q-learning, gpt) - 🧠 NN (55%): throttle (94.9%) | 🎮 QL (23%): block (75.0%) | 🤖 Claude (23%): monitor (70.0%) | ⚖️ dynamic+boosted weights...
Detected: 2026-03-24T06:14:03.822Z
show less
Bad Web Bot
🇧🇪
cmbplf
2026-03-24 04:12:05
(3 months ago)
192 requests with url.path */wp-includes/wlwmanifest.xml
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-03-22 10:45:45
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 185.228.3.17 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 185.228.3.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 06:45:39.196471 2026] [security2:error] [pid 13116:tid 13116] [client 185.228.3.17:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kryptonome.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kryptonome.com"] [uri "/backup/mysql.sql"] [unique_id "ab_IU-CM5Wa13JYQsDQhKgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 03:27:38
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 185.228.3.17 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 185.228.3.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 23:27:30.096143 2026] [security2:error] [pid 28842:tid 28842] [client 185.228.3.17:46575] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bwill.dev|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bwill.dev"] [uri "/old/backup.sql"] [unique_id "ab4QIsm4efADd8fljM_wnwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-03-20 20:22:17
(3 months ago)
10 attempts against mh-misc-ban on frost
Web App Attack