🇫🇷
dynamix
2026-09-17 03:48:06
(13 hours ago)
Multiple WAF Violations
Web App Attack
🇩🇪
LRob
2026-09-17 02:42:40
(14 hours ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /.env.swp (+12 more) | 2026-09-17 02:42 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-16 21:06:06
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 2.25.104.58 (srv1899171.hstgr.cloud): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 2.25.104.58 (srv1899171.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 17:06:01.569261 2026] [security2:error] [pid 25208:tid 25208] [client 2.25.104.58:47054] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.stoughtonpipeandwelding.net"] [uri "/wp-config.php.swp"] [unique_id "aqsEuVfPjT3RLWsEKinQwQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-16 19:19:49
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 2.25.104.58 (srv1899171.hstgr.cloud): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 2.25.104.58 (srv1899171.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 15:19:44.539877 2026] [security2:error] [pid 30517:tid 30517] [client 2.25.104.58:45508] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.abeltours.com"] [uri "/wp-config.php.bak"] [unique_id "aqrr0Fb0zMp3CnX8PwpgNgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
2000cn.com.au
2026-09-16 11:18:39
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-cve-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-16 09:36:47
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2.25.104.58 (srv1899171.hstgr.cloud): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 2.25.104.58 (srv1899171.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 05:36:40.196206 2026] [security2:error] [pid 2438377:tid 2438377] [client 2.25.104.58:46630] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "joevallone.com"] [uri "/wp-config.php.bak"] [unique_id "aqpjKKv4XUPjXCE9p3v67gAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-13 16:09:33
(4 days ago)
Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ...
show more
Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for | method: GET | path: /wp-json/gravitysmtp/v1/tests/mock-data | 2026-09-13 16:09 UTC
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-13 13:30:52
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 2.25.104.58 (srv1899171.hstgr.cloud): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 2.25.104.58 (srv1899171.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 09:30:48.360306 2026] [security2:error] [pid 24693:tid 24693] [client 2.25.104.58:33326] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.tcit.org"] [uri "/.env"] [unique_id "aqaliCpNoyipzMfVJ58p5QAAADU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 14:43:45
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 2.25.104.58 (srv1899171.hstgr.cloud): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 2.25.104.58 (srv1899171.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 10:43:42.190840 2026] [security2:error] [pid 7714:tid 7714] [client 2.25.104.58:44856] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "test.kbalan.com"] [uri "/wp-config.php.bak"] [unique_id "aqVlHnWTisrLBiAbSRblGgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 13:10:09
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 2.25.104.58 (srv1899171.hstgr.cloud): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 2.25.104.58 (srv1899171.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 09:10:05.421489 2026] [security2:error] [pid 5853:tid 5853] [client 2.25.104.58:51362] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cnphilos.com"] [uri "/wp-config.php.txt"] [unique_id "aqVPLckgnipBeDFjrTZ8EwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack