🇵🇱
Budyn
2026-09-30 04:49:02
(4 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: budyn.xyz | URI: /wp-content/plugins/ultimate-addons-for-contact-form-7/readme.txt | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131.0 | BODY: [Empty / GET Request]
show less
Hacking
Web App Attack
🇳🇱
homeshowdomain.nl
2026-09-29 21:59:03
(5 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-28.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-09-28 01:56:08
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 188.137.246.98 (188-137-246-98.netherlands-3.vp ...
show more
(mod_security) mod_security (id:210492) triggered by 188.137.246.98 (188-137-246-98.netherlands-3.vps.ac): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 27 21:56:03.594156 2026] [security2:error] [pid 31903:tid 31945] [client 188.137.246.98:43508] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "duplexgoldmine.com"] [uri "/wp-config.php.bak"] [unique_id "arnJMz77Vb3WeqOpm8mKVgAAAEE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-27 18:19:17
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 188.137.246.98 (188-137-246-98.netherlands-3.vp ...
show more
(mod_security) mod_security (id:210492) triggered by 188.137.246.98 (188-137-246-98.netherlands-3.vps.ac): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 27 14:19:11.844784 2026] [security2:error] [pid 14105:tid 14149] [client 188.137.246.98:51030] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gabegabel.prismatik.com"] [uri "/wp-config.php.bak"] [unique_id "arleH-zKNBUQP7kB4I75eQAAAcA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-09-27 11:38:36
(1 week ago)
Path Traversal Attack (/../) or (/.../). Pattern match "(?i)(?: (930100-197)
Hacking
🇺🇸
TPI-Abuse
2026-09-27 03:44:52
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 188.137.246.98 (188-137-246-98.netherlands-3.vp ...
show more
(mod_security) mod_security (id:210492) triggered by 188.137.246.98 (188-137-246-98.netherlands-3.vps.ac): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 23:44:45.821003 2026] [security2:error] [pid 22551:tid 22551] [client 188.137.246.98:39374] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mkdesignndetailing.com"] [uri "/wp-config.php.bak"] [unique_id "ariRLenw8Bpjzkgsp1_rsgAAACg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 05:01:59
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 188.137.246.98 (188-137-246-98.netherlands-3.vp ...
show more
(mod_security) mod_security (id:210492) triggered by 188.137.246.98 (188-137-246-98.netherlands-3.vps.ac): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 01:01:52.293698 2026] [security2:error] [pid 12464:tid 12499] [client 188.137.246.98:33998] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.reghay.com"] [uri "/wp-config.php.bak"] [unique_id "aqt0QNEWWWt5vu4hNBxDbgAAAcE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-09-17 01:08:20
(2 weeks ago)
URL file extension is restricted by policy. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ ...
show more
URL file extension is restricted by policy. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. (920440-131)
show less
Hacking
🇨🇦
polycoda
2026-09-15 16:01:55
(2 weeks ago)
⌨️ Probes for /wp-config everywhere
Hacking
Web App Attack
🇨🇦
polycoda
2026-09-15 15:07:17
(2 weeks ago)
AutoBlock: ⚙️ Configuration File Access (Non Decay-Based)
Hacking
Web App Attack
🇮🇹
VHosting
2026-09-14 01:10:03
(3 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇨🇭
YF
2026-09-13 00:06:35
(3 weeks ago)
Malicious web activity confirmed — IP previously flagged as suspicious (automated re-check, score: 1 ...
show more
Malicious web activity confirmed — IP previously flagged as suspicious (automated re-check, score: 16%)
show less
Web App Attack
🇲🇾
Rizzy
2026-09-12 18:14:29
(3 weeks ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 13:23:09
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 188.137.246.98 (188-137-246-98.netherlands-3.vp ...
show more
(mod_security) mod_security (id:210492) triggered by 188.137.246.98 (188-137-246-98.netherlands-3.vps.ac): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 09:23:02.914050 2026] [security2:error] [pid 26126:tid 26126] [client 188.137.246.98:54530] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.bikinitweets.com"] [uri "/wp-config.php.save"] [unique_id "aqVSNoS_uhsoKGtJN9WxRAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 12:40:17
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 188.137.246.98 (188-137-246-98.netherlands-3.vp ...
show more
(mod_security) mod_security (id:210492) triggered by 188.137.246.98 (188-137-246-98.netherlands-3.vps.ac): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 08:40:10.885079 2026] [security2:error] [pid 23940:tid 24007] [client 188.137.246.98:44142] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vinylnotespodcast.com"] [uri "/wp-config.php~"] [unique_id "aqVIKsDMoD1AvlrE2B6KpQAAAYY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
