🇧🇷
ICS Labs
2026-10-27 18:06:34
UTC ·
(2 weeks ago)
ICS Labs threat intelligence (ICS Feeds): Exploited Host. Last observed 2026-10-27 UTC.
Exploited Host
🇺🇸
IndigoRidge
2026-10-25 20:56:48
UTC ·
(2 weeks ago)
185.228.3.22 - - [25/Oct/2026:16:56:36 -0400] "GET /wp-content/plugins/neoncore-themes/O/SrHD3odefault.php HTTP/1.1" 404 74715 "http://www.carolinacreativegroup.com/wp-content/plugins/neoncore-themes/O/SrHD3odefault.php" "Go-http-client/2.0"
185.228. ...
show more
185.228.3.22 - - [25/Oct/2026:16:56:36 -0400] "GET /wp-content/plugins/neoncore-themes/O/SrHD3odefault.php HTTP/1.1" 404 74715 "http://www.carolinacreativegroup.com/wp-content/plugins/neoncore-themes/O/SrHD3odefault.php" "Go-http-client/2.0"
185.228.3.22 - - [25/Oct/2026:16:56:40 -0400] "GET /wp-content/plugins/bbpress/file5.php HTTP/1.1" 404 74735 "http://www.carolinacreativegroup.com/wp-content/plugins/bbpress/file5.php" "Go-http-client/2.0"
185.228.3.22 - - [25/Oct/2026:16:56:42 -0400] "GET /wp-content/plugins/buddypress/alfa.php HTTP/1.1" 404 74737 "http://www.carolinacreativegroup.com/wp-content/plugins/buddypress/alfa.php" "Go-http-client/2.0"
185.228.3.22 - - [25/Oct/2026:16:56:43 -0400] "GET /wp-content/plugins/enhanced-text-widget/analyst/src/403x.php HTTP/1.1" 404 74759 "http://www.carolinacreativegroup.com/wp-content/plugins/enhanced-text-widget/analyst/src/403x.php" "Go-http-client/2.0"
185.228.3.22 - - [25/Oct/2026:16:56:47 -0400] "GET /wp-content/plugins/hello-plus/classe
...
show less
Web App Attack
🇫🇮
pixiekat
2026-10-25 17:11:03
UTC ·
(2 weeks ago)
Banned by fail2ban (apache-goscanner, 1 hits) [msg "get tae fuck go scanner"]
Bad Web Bot
🇩🇪
ghostwarriors
2026-10-25 15:50:25
UTC ·
(2 weeks ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-10-09 00:10:04
UTC ·
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇨🇭
Origon
2026-09-14 15:46:35
UTC ·
(1 month ago)
http-wordpress-scan - IP: 185.228.3.22 - time="2026-09-14T17:46:35+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-wordpress-scan by ip 185.228.3.22 (PT/206092) : 4h ban on Ip 185.228.3.22" modul ...
show more
http-wordpress-scan - IP: 185.228.3.22 - time="2026-09-14T17:46:35+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-wordpress-scan by ip 185.228.3.22 (PT/206092) : 4h ban on Ip 185.228.3.22" module=db
show less
Web App Attack
2026-09-09 14:34:01
UTC ·
(2 months ago)
Blocked: Reason='Vulnerability probing — PHP scan detected (18/60 min)'; Requests=18
Port Scan
🇺🇸
TPI-Abuse
2026-07-07 00:27:02
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 185.228.3.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 20:26:57.978871 2026] [security2:error] [pid 9114:tid 9114] [client 185.228.3.22:0] ModSecuri ...
show more
(mod_security) mod_security (id:210492) triggered by 185.228.3.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 20:26:57.978871 2026] [security2:error] [pid 9114:tid 9114] [client 185.228.3.22:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kidswithcamerasmovie.com"] [uri "/.env"] [unique_id "akxH0aW_AqeUn-OkVsF8WgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-04-22 19:25:22
UTC ·
(6 months ago)
IM360 WAF: Laravel .env file access
Web App Attack
🇦🇺
rubixstudios
2026-03-28 11:20:03
UTC ·
(7 months ago)
Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360
DDoS Attack
Brute-Force
Web App Attack
🇺🇸
octageeks.com
2026-03-28 04:07:01
UTC ·
(7 months ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇫🇷
dynamix
2026-03-27 21:42:55
UTC ·
(7 months ago)
Multiple WAF Violations
Web App Attack
🇩🇪
AetherFox
2026-03-27 10:52:53
UTC ·
(7 months ago)
[Fri Mar 27 10:52:52.723193 2026] [authz_core:error] [pid 500189:tid 500233] [client 185.228.3.22:29659] AH01630: client denied by server configuration: proxy:http://5.75.191.34/manager.php
[Fri Mar 27 10:52:52.723406 2026] [authz_core:error] [pid 50 ...
show more
[Fri Mar 27 10:52:52.723193 2026] [authz_core:error] [pid 500189:tid 500233] [client 185.228.3.22:29659] AH01630: client denied by server configuration: proxy:http://5.75.191.34/manager.php
[Fri Mar 27 10:52:52.723406 2026] [authz_core:error] [pid 500189:tid 500233] [client 185.228.3.22:29659] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html
[Fri Mar 27 10:52:52.886134 2026] [authz_core:error] [pid 500189:tid 500211] [client 185.228.3.22:29659] AH01630: client denied by server configuration: proxy:http://5.75.191.34/O-Simple.php
[Fri Mar 27 10:52:52.886303 2026] [authz_core:error] [pid 500189:tid 500211] [client 185.228.3.22:29659] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html
[Fri Mar 27 10:52:52.963715 2026] [authz_core:error] [pid 500189:tid 500199] [client 185.228.3.22:29659] AH01630: client denied by server configuration: proxy:http://5.75.191.34/lock360.php
...
show less
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-03-24 06:24:56
UTC ·
(7 months ago)
309 requests with url.path */wp-includes/wlwmanifest.xml
Brute-Force
Bad Web Bot
🇺🇸
integrantservices.com
2026-03-24 05:53:36
UTC ·
(7 months ago)
(PERMBLOCK) 185.228.3.22 (PT/Portugal/-) has had more than 4 temp blocks
Hacking
