🇩🇪
Wolfgang
2023-12-18 08:32:03
(2 years ago)
A bunch of unsuccessful GET trials (non-existent PHP stuff). What a nasty guy!
Brute-Force
Web App Attack
🇬🇧
blik2108
2023-12-17 07:21:48
(2 years ago)
wight.blacknell.co.uk:80 193.236.42.8 - - [17/Dec/2023:07:21:46 +0000] "GET /wp-config.php HTTP/1.1" ...
show more
wight.blacknell.co.uk:80 193.236.42.8 - - [17/Dec/2023:07:21:46 +0000] "GET /wp-config.php HTTP/1.1" 404 491 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:31.0) Gecko/20100101 Firefox/31.0"
wight.blacknell.co.uk:80 193.236.42.8 - - [17/Dec/2023:07:21:47 +0000] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 491 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:31.0) Gecko/20100101 Firefox/31.0"
wight.blacknell.co.uk:80 193.236.42.8 - - [17/Dec/2023:07:21:47 +0000] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 491 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:31.0) Gecko/20100101 Firefox/31.0"
wight.blacknell.co.uk:80 193.236.42.8 - - [17/Dec/2023:07:21:47 +0000] "GET /phpmyadmin/scripts/db___.init.php HTTP/1.1" 404 491 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:31.0) Gecko/20100101 Firefox/31.0"
wight.blacknell.co.uk:80 193.236.42.8 - - [17/Dec/2023:07:21:47 +0000] "GET /phpMyAdmin/scripts/db___.init.php HTTP/1.1" 404 491 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:
...
show less
Brute-Force
Web App Attack
🇩🇪
ISPLtd
2023-12-16 10:52:34
(2 years ago)
Dec 16 06:52:27 SRC=193.236.42.8 PROTO=TCP SPT=17761 DPT=8080 SYN
Dec 16 06:52:30 SRC=193.236.42.8 P ...
show more
Dec 16 06:52:27 SRC=193.236.42.8 PROTO=TCP SPT=17761 DPT=8080 SYN
Dec 16 06:52:30 SRC=193.236.42.8 PROTO=TCP SPT=17883 DPT=8983 SYN
Dec 16 06:52:33 SRC=193.236.42.8 PROTO=TCP SPT=17883 DPT=8983
...
show less
Port Scan
🇷🇸
Smel
2023-12-15 18:15:16
(2 years ago)
MH/MP Probe, Scan, Hack -
Port Scan
Hacking
🇺🇸
gu-alvareza
2023-12-13 07:05:15
(2 years ago)
Suspicious.PHP.URI.Location
Hacking
Web App Attack
2023-12-10 16:31:48
(2 years ago)
Port Scan
🇺🇸
gu-alvareza
2023-12-09 07:05:14
(2 years ago)
Suspicious.PHP.URI.Location
Hacking
Web App Attack
🇳🇱
vlamke
2023-12-09 04:26:05
(2 years ago)
[Sat Dec 09 05:26:04.628520 2023] [proxy_fcgi:error] [pid 1153:tid 139645090232064] [client 193.236. ...
show more
[Sat Dec 09 05:26:04.628520 2023] [proxy_fcgi:error] [pid 1153:tid 139645090232064] [client 193.236.42.8:17217] AH01071: Got error 'Primary script unknown'
[Sat Dec 09 05:26:04.686454 2023] [proxy_fcgi:error] [pid 1153:tid 139645115410176] [client 193.236.42.8:17217] AH01071: Got error 'Primary script unknown'
[Sat Dec 09 05:26:04.745571 2023] [proxy_fcgi:error] [pid 1153:tid 139645081839360] [client 193.236.42.8:17217] AH01071: Got error 'Primary script unknown'
show less
Brute-Force
SSH
2023-12-08 23:01:22
(2 years ago)
Common attack or app scan event detected and blocked
Port Scan
Hacking
Web App Attack
🇧🇷
ufn.edu.br
2023-12-08 09:17:05
(2 years ago)
[Fri Dec 08 07:17:03.877080 2023] [access_compat:error] [pid 7902] [client 193.236.42.8:12677] AH017 ...
show more
[Fri Dec 08 07:17:03.877080 2023] [access_compat:error] [pid 7902] [client 193.236.42.8:12677] AH01797: client denied by server configuration: /var/www/html/java.php
[Fri Dec 08 07:17:04.147676 2023] [access_compat:error] [pid 7902] [client 193.236.42.8:12677] AH01797: client denied by server configuration: /var/www/html/_query.php
[Fri Dec 08 07:17:04.413549 2023] [access_compat:error] [pid 7902] [client 193.236.42.8:12677] AH01797: client denied by server configuration: /var/www/html/test.php
...
show less
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2023-12-08 01:37:58
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 193.236.42.8 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 193.236.42.8 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 07 20:37:54.577483 2023] [security2:error] [pid 3463] [client 193.236.42.8:10196] [client 193.236.42.8] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.202"] [uri "/wp-config.php"] [unique_id "ZXJzctUe5o3zvOx7-x6QPwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
GAS
2023-12-07 21:06:03
(2 years ago)
GET / HTTP/1.1 - Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Port Scan
Hacking
🇺🇸
RAP
2023-12-07 08:32:04
(2 years ago)
2023-12-07 08:32:04 UTC Unauthorized activity to TCP port 8080. Web App
Port Scan
Web App Attack
🇺🇸
gu-alvareza
2023-12-03 07:05:11
(2 years ago)
Suspicious.PHP.URI.Location
Hacking
Web App Attack
🇳🇱
Savvii
2023-11-29 14:42:49
(2 years ago)
28 attempts against mh-misbehave-ban on melon
Brute-Force
Bad Web Bot
Web App Attack