🇩🇪
Vegascosmetics
2025-09-17 21:52:06
(11 months ago)
Kingcopy(AI-IDS): IP is wandering around the site and acting suspiciously.
Bad Web Bot
🇩🇪
LRob
2025-09-17 02:31:39
(11 months ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
2025-09-17 02:05:17
(11 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
2025-09-17 01:40:36
(11 months ago)
20.41.84.180 (KR/South Korea/-), more than 10 Apache 403 hits
Hacking
🇺🇦
URAN Publishing Service
2025-09-17 01:31:53
(11 months ago)
20.41.84.180 - - [17/Sep/2025:04:31:53 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php ...
show more
20.41.84.180 - - [17/Sep/2025:04:31:53 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 277 "-" "-"
...
show less
Web App Attack
🇩🇪
stinpriza
2025-09-17 01:19:07
(11 months ago)
common Web Exploits being scanned
Web App Attack
🇱🇻
garmtech.com
2025-09-17 01:16:25
(11 months ago)
Attempted access to sensitive endpoint (/wp-content/plugins/hellopress/wp_filemanager.php) detected. ...
show more
Attempted access to sensitive endpoint (/wp-content/plugins/hellopress/wp_filemanager.php) detected. Automated scan or unauthorized probing.
show less
Web App Attack
🇳🇱
Site.eu
2025-09-17 01:02:09
(11 months ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2025-09-17 00:54:32
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 20.41.84.180 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 20.41.84.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 16 20:54:25.980372 2025] [security2:error] [pid 3454:tid 3454] [client 20.41.84.180:7350] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hierarchyofvalues.org"] [uri "/wp-config.php.un~"] [unique_id "aMoGwSAVDpR3SzEO_3l4gQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-09-17 00:52:02
(11 months ago)
Ports: *; Direction: 0; Trigger: CT_LIMIT
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-09-16 23:57:02
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 20.41.84.180 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 20.41.84.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 16 19:56:56.069549 2025] [security2:error] [pid 28185:tid 28185] [client 20.41.84.180:8586] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "joqlawn.com"] [uri "/wp-config.php.un~"] [unique_id "aMn5SButdrF3sNOI1dWXmAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-09-16 23:51:03
(11 months ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
TPI-Abuse
2025-09-16 23:26:39
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 20.41.84.180 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 20.41.84.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 16 19:26:32.471589 2025] [security2:error] [pid 4829:tid 4829] [client 20.41.84.180:4109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "qwixel.com"] [uri "/wp-config.php.un~"] [unique_id "aMnyKGx1nSB_hJeNA2MiMgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-16 23:05:09
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 20.41.84.180 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 20.41.84.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 16 19:05:02.502720 2025] [security2:error] [pid 22930:tid 22930] [client 20.41.84.180:6510] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "astrologydemo.com"] [uri "/wp-config.php.un~"] [unique_id "aMntHuL3xxgK8OLv7PmBCQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
IRT@Unisi
2025-09-16 23:01:13
(11 months ago)
Multiple web server 400 error codes from same source ip.
Bad Web Bot