2024-09-13 01:00:24
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇩🇪
kernel-error.de
2024-09-09 19:20:16
(1 year ago)
::ffff:193.172.88.164 - - [09/Sep/2024:21:08:58 +0200] "GET /wp-login.php HTTP/1.1" 404 10477 "https ...
show more
::ffff:193.172.88.164 - - [09/Sep/2024:21:08:58 +0200] "GET /wp-login.php HTTP/1.1" 404 10477 "https://kernel-error.de/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0"
::ffff:193.172.88.164 - - [09/Sep/2024:21:13:27 +0200] "GET /a/pma/ HTTP/1.1" 404 10477 "https://kernel-error.de/a/pma/" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.201 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
::ffff:193.172.88.164 - - [09/Sep/2024:21:20:15 +0200] "GET /db/phpmyadmin HTTP/1.1" 404 10477 "https://kernel-error.de/db/phpmyadmin" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.201 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2024-09-08 02:08:20
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 193.172.88.164 (193-172-88-164.nbt.nl): 1 in th ...
show more
(mod_security) mod_security (id:210730) triggered by 193.172.88.164 (193-172-88-164.nbt.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 07 22:08:16.174928 2024] [security2:error] [pid 1188124:tid 1188126] [client 193.172.88.164:41832] [client 193.172.88.164] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||socialanxietywebsite.com|F|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "socialanxietywebsite.com"] [uri "/htdocs.bak"] [unique_id "Zt0HEKt7iD-qpZFn-K3_FgAAAMA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-09-06 18:13:29
(1 year ago)
wordpress-trap
Web App Attack
2024-08-28 09:55:36
(1 year ago)
wordpress-trap
Web App Attack
2024-08-28 06:51:14
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2024-08-18 06:47:27
(1 year ago)
wordpress-trap
Web App Attack
2024-08-16 04:43:30
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_MODSEC
Brute-Force
SSH
🇺🇸
TPI-Abuse
2024-08-15 12:22:29
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 193.172.88.164 (193-172-88-164.nbt.nl): 1 in th ...
show more
(mod_security) mod_security (id:210730) triggered by 193.172.88.164 (193-172-88-164.nbt.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 15 08:22:24.985924 2024] [security2:error] [pid 8842:tid 8842] [client 193.172.88.164:58110] [client 193.172.88.164] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.rimworld.com|F|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.rimworld.com"] [uri "/notra/code.bak"] [unique_id "Zr3zAIA-d9V02TNMiU7AiwAAACw"], referer: http://northernohiotra.com/code.bak
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-08-15 02:33:44
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2024-08-09 11:03:16
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 193.172.88.164 (193-172-88-164.nbt.nl): 1 in th ...
show more
(mod_security) mod_security (id:210492) triggered by 193.172.88.164 (193-172-88-164.nbt.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 09 07:03:12.240008 2024] [security2:error] [pid 13303:tid 13303] [client 193.172.88.164:41454] [client 193.172.88.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cruanyes.com"] [uri "/.env.bak"] [unique_id "ZrX3cI0AUyn8S9V31EJslwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-08-08 22:29:58
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2024-08-08 04:45:59
(1 year ago)
wordpress-trap
Web App Attack
2024-08-06 18:41:23
(1 year ago)
(wordpress) Failed wordpress login from 193.172.88.164 (NL/Netherlands/193-172-88-164.nbt.nl): (CF_ ...
show more
(wordpress) Failed wordpress login from 193.172.88.164 (NL/Netherlands/193-172-88-164.nbt.nl): (CF_ENABLE)
show less
Brute-Force
🇺🇸
TPI-Abuse
2024-08-03 10:21:07
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 193.172.88.164 (193-172-88-164.nbt.nl): 1 in th ...
show more
(mod_security) mod_security (id:210492) triggered by 193.172.88.164 (193-172-88-164.nbt.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 03 06:20:59.722903 2024] [security2:error] [pid 28673:tid 28673] [client 193.172.88.164:48790] [client 193.172.88.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "beercruisers.com"] [uri "/.env.bak"] [unique_id "Zq4Ei6AYZ4xOodIqR3IdRAAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack