🇺🇸
TPI-Abuse
2026-09-23 14:12:37
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 10:12:29.870325 2026] [security2:error] [pid 27113:tid 27129] [client 185.48.117.177:32828] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "conservativedemocrat.aafm.us"] [uri "/wp-config.php.save"] [unique_id "arPeTcSh9POjGdj3T5gmoAAAAIc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 04:41:01
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 00:40:52.700795 2026] [security2:error] [pid 24257:tid 24257] [client 185.48.117.177:41986] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cnphilos.com"] [uri "/wp-config.php~"] [unique_id "aqtvVCHsb1dUNwxvvwnqhwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-17 03:28:25
(1 week ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-17 03:08:15
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 23:08:07.854784 2026] [security2:error] [pid 7320:tid 7320] [client 185.48.117.177:46404] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "morninginc.com"] [uri "/wp-config.php~"] [unique_id "aqtZl1BfXkV9VGfua2E1iQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-17 02:41:58
(1 week ago)
[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 185.48.117.177 - - [17/Sep/2026:04:41:39 +0200] "GET /wp-config.php.bak HTTP/1.1" 301 6499 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TAY
2026-09-17 02:40:22
(1 week ago)
185.48.117.177 - - [17/Sep/2026:10:40:06 +0800] "GET /wp-config.php.bak HTTP/1.1" 301 486 "-" "Mozil ...
show more
185.48.117.177 - - [17/Sep/2026:10:40:06 +0800] "GET /wp-config.php.bak HTTP/1.1" 301 486 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
185.48.117.177 - - [17/Sep/2026:10:40:12 +0800] "GET /wp-config.php.bak HTTP/1.1" 404 54884 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
185.48.117.177 - - [17/Sep/2026:10:40:19 +0800] "GET /wp-config.php~ HTTP/1.1" 301 480 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
185.48.117.177 - - [17/Sep/2026:10:40:19 +0800] "GET /wp-config.php~ HTTP/1.1" 404 54903 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
185.48.117.177 - - [17/Sep/2026:10:40:20 +0800] "GET /wp-config.php.save HTTP/1.1" 301 488 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like
...
show less
Brute-Force
2026-09-17 02:15:03
(1 week ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 02:13:28
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 22:13:21.438412 2026] [security2:error] [pid 29788:tid 29788] [client 185.48.117.177:37172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tenmenband.com"] [uri "/wp-config.php~"] [unique_id "aqtMwec6nzgpI_WqHsv3fAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-17 02:09:21
(1 week ago)
[ssd1.kdns.gr] httpd-config-scan: sites=www.lifeenlighteningproject.com; logs=/var/log/httpd/access_ ...
show more
[ssd1.kdns.gr] httpd-config-scan: sites=www.lifeenlighteningproject.com; logs=/var/log/httpd/access_log,/var/log/httpd/domains/lifeenlighteningproject.com.log; samples=/wp-config.php.bak | /wp-config.php~ | /wp-config.php.save
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 01:43:10
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 21:43:05.691610 2026] [security2:error] [pid 14189:tid 14252] [client 185.48.117.177:53966] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rawhabitat.com"] [uri "/wp-config.php.txt"] [unique_id "aqtFqQJSxVCmEq0OjZyDhAAAAgU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
VanKoh
2026-09-17 01:22:27
(1 week ago)
185.48.117.177 - - [16/Sep/2026:19:22:26 -0600] "GET /wp-json/gravitysmtp/v1/tests/mock-data HTTP/1. ...
show more
185.48.117.177 - - [16/Sep/2026:19:22:26 -0600] "GET /wp-json/gravitysmtp/v1/tests/mock-data HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
185.48.117.177 - - [16/Sep/2026:19:22:26 -0600] "GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
185.48.117.177 - - [16/Sep/2026:19:22:27 -0600] "GET /?rest_route=/gravitysmtp/v1/tests/mock-data&page=gravitysmtp-settings HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
...
show less
DDoS Attack
Web App Attack
🇩🇪
4server
2026-09-17 01:02:31
(1 week ago)
[ThuSep1703:02:26.3215582026][security2:error][pid1454286:tid1454384][client185.48.117.177:0]ModSecu ...
show more
[ThuSep1703:02:26.3215582026][security2:error][pid1454286:tid1454384][client185.48.117.177:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"risparmiocasasuisse.ch\"][uri\"/wp-config.php.old\"][unique_id\"aqs8Iss2J8OvsrAyDhkVjgAAAQM\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 00:42:16
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 20:42:12.050824 2026] [security2:error] [pid 27834:tid 27834] [client 185.48.117.177:50742] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kporterdesign.com"] [uri "/wp-config.php.bak"] [unique_id "aqs3ZEQJ72Pdt2A72RcS1QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
taivas.nl
2026-09-17 00:32:01
(1 week ago)
Wordpress_Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 03:04:00
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 185.48.117.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 23:03:54.452366 2026] [security2:error] [pid 5067:tid 5067] [client 185.48.117.177:38338] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drgtek.com"] [uri "/wp-config.php.old"] [unique_id "ap97GvUeBvx4Ze3nOSX76AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
