🇺🇸
TPI-Abuse
2026-09-23 15:14:07
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): ...
show more
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 11:14:03.019302 2026] [security2:error] [pid 17038:tid 17038] [client 194.163.139.10:52206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.internetnameregistration.com"] [uri "/wp-config.php~"] [unique_id "arPsu4BkzPLm99Wppj3rfAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 14:24:33
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): ...
show more
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 10:24:28.211659 2026] [security2:error] [pid 2552659:tid 2552659] [client 194.163.139.10:57216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dynamic-therapy-mn.com"] [uri "/wp-config.php.old"] [unique_id "arPhHNuDClq-SZ_Qzxj92gAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
solution.it
2026-09-23 14:04:58
(1 week ago)
[Wed Sep 23 16:04:58.283897 2026] [php7:error] [pid 2177076:tid 2177076] [client 194.163.139.10:3483 ...
show more
[Wed Sep 23 16:04:58.283897 2026] [php7:error] [pid 2177076:tid 2177076] [client 194.163.139.10:34838] script '/var/www/html/blog.solution.it/phpinfo.php' not found or unable to stat
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 12:37:30
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): ...
show more
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 08:37:24.534639 2026] [security2:error] [pid 30650:tid 30650] [client 194.163.139.10:37656] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.covid19.mavikalem.org"] [uri "/wp-config.php.save"] [unique_id "arPIBPUQkbhxzAgFNWoFCAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-09-23 11:53:40
(1 week ago)
csagent: score 20.2: wp-config backup grab x2, 404 noise floor x1; 1 domain(s) in 1s
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 11:47:30
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): ...
show more
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 07:47:24.541554 2026] [security2:error] [pid 11003:tid 11003] [client 194.163.139.10:59148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aimer.es"] [uri "/wp-config.php.bak"] [unique_id "arO8TCWJQoBElZHLswG6xQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 08:31:32
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): ...
show more
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 04:31:26.620859 2026] [security2:error] [pid 30787:tid 30787] [client 194.163.139.10:37354] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.femalegamblers.mobileonlinecasinos.co"] [uri "/wp-config.php~"] [unique_id "arOOXtv5Ee6TH9aXwnIFNwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-23 06:18:55
(1 week ago)
[ti-02ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-02ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 194.163.139.10 - - [23/Sep/2026:08:18:40 +0200] "GET /wp-config.php.save HTTP/1.1" 301 6260 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇧🇪
taivas.nl
2026-09-23 04:32:48
(1 week ago)
Many_bad_calls
Web App Attack
🇺🇸
dot.mg
2026-09-23 03:03:04
(1 week ago)
Bruteforce
Bad Web Bot
2026-09-23 01:25:48
(1 week ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 00:59:28
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): ...
show more
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 20:59:24.036824 2026] [security2:error] [pid 19333:tid 19333] [client 194.163.139.10:49420] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "doreenkimura.com.misscharlottemusic.com"] [uri "/wp-config.php.bak"] [unique_id "arMkbDIgkfHlD2VbEk5P5QAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
soc-yk
2026-09-22 23:54:10
(1 week ago)
Type: suspicious_network_activity
Risk: 75
Events: 9
Evidence:
- Persistent suspicious network acti ...
show more
Type: suspicious_network_activity
Risk: 75
Events: 9
Evidence:
- Persistent suspicious network activity detected
- Repeated hostile operational behavior observed
- Threat escalation behavior observed
show less
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-09-22 23:40:11
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): ...
show more
(mod_security) mod_security (id:210492) triggered by 194.163.139.10 (mail.mon-assistant-perso.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 19:40:09.445433 2026] [security2:error] [pid 13878:tid 13878] [client 194.163.139.10:58398] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.susanleeward.com"] [uri "/wp-config.php.txt"] [unique_id "arMR2fi9WABnpTv1UHFo1wAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-22 22:51:49
(1 week ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
