🇩🇪
neckaralb-admin.de
2026-10-23 05:36:48
(1 day ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
nyt
2026-10-21 23:43:59
(2 days ago)
Repeated WordPress login POSTs blocked by WAF (3 in 6h)
Brute-Force
Web App Attack
🇳🇴
jad-abuse
2026-10-18 20:06:57
(5 days ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe, git_exposure, db_dump, source_backup. Observed by 1 sensor(s); 14 hits.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 13:13:38
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.238.231.189 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 185.238.231.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 09:13:31.740897 2026] [security2:error] [pid 30410:tid 30410] [client 185.238.231.189:24747] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.register-yacht-belgium.com.yacht-register-holland.com"] [uri "/conf/.env"] [unique_id "as9_-3fy-umFl2YN8u4_4AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 11:22:01
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.238.231.189 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 185.238.231.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 07:21:54.215819 2026] [security2:error] [pid 9440:tid 9528] [client 185.238.231.189:35107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.wpe.uk.com"] [uri "/app/.env"] [unique_id "as9l0h8Gb76Obe0VYaP4_QAAANI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 08:24:05
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.238.231.189 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 185.238.231.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 04:24:00.808412 2026] [security2:error] [pid 22460:tid 22460] [client 185.238.231.189:42451] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oxyveggietv.com.mroxygen.org"] [uri "/composer.json"] [unique_id "as88INJGtF-NxTXJq06hjQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 07:59:10
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 185.238.231.189 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 185.238.231.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 03:59:06.075452 2026] [security2:error] [pid 2777:tid 2777] [client 185.238.231.189:27985] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||carolinafootprints.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "carolinafootprints.com"] [uri "/backup.sql"] [unique_id "as82SnlwPBObVKY5Gn_7CwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Kirk Wilkinson
2026-10-05 18:30:00
(2 weeks ago)
malicious login activity
Brute-Force
🇺🇸
wristhulk
2026-10-04 21:31:22
(2 weeks ago)
Honeypot: 232 RDP connection probes in 1 hour on OpenCanary honeypot (port 3389). (21 attempts)
Brute-Force
🇺🇸
wristhulk
2026-10-04 21:16:20
(2 weeks ago)
Honeypot: RDP brute-force on OpenCanary honeypot (port 3389). Username: 'hello'. (22 attempts)
Brute-Force
🇺🇸
IndigoRidge
2026-10-04 21:14:24
(2 weeks ago)
Knock-Knock RDP honeypot activity; time=2026-10-04 21:08:46; username=hello
Brute-Force
🇺🇸
JakeddoT
2026-10-04 07:20:50
(2 weeks ago)
Windows RDP brute force: 1440 failed logins between 2026-10-04 01:47 and 2026-10-04 07:20 UTC. Usern ...
show more
Windows RDP brute force: 1440 failed logins between 2026-10-04 01:47 and 2026-10-04 07:20 UTC. Usernames tried include: PAUL, MORNINGSTAR, LOGIN4, ROLFAALTO.
show less
Brute-Force
🇺🇸
wristhulk
2026-10-03 21:29:30
(2 weeks ago)
Honeypot: 20 RDP connection probes in 1 hour on OpenCanary honeypot (port 3389). (68 attempts)
Brute-Force
🇺🇸
wristhulk
2026-10-03 21:14:26
(2 weeks ago)
Honeypot: RDP brute-force on OpenCanary honeypot (port 3389). Username: 'hello'. (18 attempts)
Brute-Force
🇺🇸
IndigoRidge
2026-10-03 21:12:24
(2 weeks ago)
Knock-Knock RDP honeypot activity; time=2026-10-03 21:10:40; username=hello
Brute-Force
