2026-07-08 18:20:30
(2 hours ago)
Web attack blocked by Wordfence on www.historischarchiefvalkenburg.nl (1 hit). Reported by CRMON.
Web App Attack
🇳🇱
middelkoopcc
2026-07-08 18:10:05
(2 hours ago)
2026-07-08 20:06:37 [client 20.2.32.231:2125] AH01071: Got error 'Primary script unknown' && 2026-07 ...
show more
2026-07-08 20:06:37 [client 20.2.32.231:2125] AH01071: Got error 'Primary script unknown' && 2026-07-08 20:06:44 [client 20.2.32.231:2125] AH01071: Got error 'Primary script unknown' && 2026-07-08 20:06:46 [client 20.2.32.231:2125] AH01071: Got error 'Primary script unknown' && 79 more within 20 minutes
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-07-08 18:05:24
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 20.2.32.231 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 20.2.32.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 14:05:19.856343 2026] [security2:error] [pid 27635:tid 27635] [client 20.2.32.231:7625] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gibraltar-boat-registration.com"] [uri "/wp-config.php"] [unique_id "ak6RX8grTXmlrr1u87A6IAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-08 17:44:19
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 20.2.32.231 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 20.2.32.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 13:44:14.790444 2026] [security2:error] [pid 19693:tid 19718] [client 20.2.32.231:5014] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.prismatik.com"] [uri "/wp-config.php"] [unique_id "ak6MbumU7S_lVs_3YEPmoQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-08 17:28:50
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 20.2.32.231 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 20.2.32.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 13:28:46.297957 2026] [security2:error] [pid 6137:tid 6137] [client 20.2.32.231:8489] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.valuerec.com"] [uri "/wp-config.php"] [unique_id "ak6IzmXUMAYDvu9IzPqM5gAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-07-08 16:26:39
(4 hours ago)
20.2.32.231 - - [08/Jul/2026:19:26:37 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php ...
show more
20.2.32.231 - - [08/Jul/2026:19:26:37 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 707 "-" "-"
20.2.32.231 - - [08/Jul/2026:19:26:38 +0300] "GET /index.php/wp-includes/PHPMailer/ HTTP/1.1" 404 628 "-" "-"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-07-08 16:10:05
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 20.2.32.231 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 20.2.32.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 12:09:56.644817 2026] [security2:error] [pid 23487:tid 23487] [client 20.2.32.231:2211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "elderlyassociation.org"] [uri "/wp-config.php"] [unique_id "ak52VAdnFwCqvQhq0cmnNAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2026-07-08 16:09:14
(4 hours ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 20.2.32.231 (HK/Hong Kon ...
show more
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 20.2.32.231 (HK/Hong Kong/-)
show less
Port Scan
🇺🇸
mnsf
2026-07-08 16:07:26
(4 hours ago)
Too many Status 40X (11)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-08 15:54:33
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 20.2.32.231 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 20.2.32.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 11:54:25.746781 2026] [security2:error] [pid 3382:tid 3382] [client 20.2.32.231:8325] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.delomel.net"] [uri "/wp-config.php"] [unique_id "ak5ysW8aDbTPIz203vsNRgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-07-08 15:49:24
(5 hours ago)
(upload_shell) srv104 Shell upload 20.2.32.231 (HK/Hong Kong/-): 1 in the last 3600 secs; Ports: *; ...
show more
(upload_shell) srv104 Shell upload 20.2.32.231 (HK/Hong Kong/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇫🇮
NoaQT
2026-07-08 15:22:48
(5 hours ago)
2026-07-08T15:22:47.667566+00:00 ingress-1 haproxy[244]: 20.2.32.231:3865 [08/Jul/2026:15:22:47.666] ...
show more
2026-07-08T15:22:47.667566+00:00 ingress-1 haproxy[244]: 20.2.32.231:3865 [08/Jul/2026:15:22:47.666] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 257/216/0/0/0 0/0 "GET /wp-login.php HTTP/1.1"
2026-07-08T15:22:47.893032+00:00 ingress-1 haproxy[244]: 20.2.32.231:3865 [08/Jul/2026:15:22:47.892] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 257/216/0/0/0 0/0 "GET /as.php HTTP/1.1"
2026-07-08T15:22:48.122843+00:00 ingress-1 haproxy[244]: 20.2.32.231:3865 [08/Jul/2026:15:22:48.121] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 257/216/0/0/0 0/0 "GET /class-t.api.php HTTP/1.1"
2026-07-08T15:22:48.357694+00:00 ingress-1 haproxy[244]: 20.2.32.231:3865 [08/Jul/2026:15:22:48.356] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 257/216/0/0/0 0/0 "GET /kbfr.php HTTP/1.1"
2026-07-08T15:22:48.608225+00:00 ingress-1 haproxy[244]: 20.2.32.231:3865 [08/Jul/2026:15:22:48.607] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 257/216/0/0/0 0/0 "GET /bless.php
...
show less
DDoS Attack
🇺🇸
TPI-Abuse
2026-07-08 15:20:42
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 20.2.32.231 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 20.2.32.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 11:20:35.808867 2026] [security2:error] [pid 27638:tid 27638] [client 20.2.32.231:3497] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.edelbaumarchitect.com"] [uri "/wp-config.php"] [unique_id "ak5qw03AePug2i5qgFJXUgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ger-stg-sifi1
2026-07-08 15:19:00
(5 hours ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
Starburst SysOp Team
2026-07-08 13:43:31
(7 hours ago)
Restricted File Access Attempt. Matched phrase "wp-config." at REQUEST_FILENAME. (930130-stl2-17)
Hacking
Web App Attack