🇧🇷
Peregrine
2026-11-14 03:10:08
UTC ·
(3 hours ago)
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 20.65.93.74 104.22.195.95 - - [12/Nov/2026:13:22:47 -0300] "GET /public/css.php HTTP/1.1" 404 414
20.65.93.74 104.22.195.95 - - [12/Nov/2026:13:22:48 -0300] "GET /classwithtostring.php HTTP/1.1" 404 414
2 ...
show more
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 20.65.93.74 104.22.195.95 - - [12/Nov/2026:13:22:47 -0300] "GET /public/css.php HTTP/1.1" 404 414
20.65.93.74 104.22.195.95 - - [12/Nov/2026:13:22:48 -0300] "GET /classwithtostring.php HTTP/1.1" 404 414
20.65.93.74 104.22.195.95 - - [12/Nov/2026:13:22:48 -0300] "GET /wp-content/admin.php HTTP/1.1" 404 414
20.65.93.74 104.22.195.95 - - [12/Nov/2026:13:22:49 -0300] "GET /gelay.php HTTP/1.1" 404 414
20.65.93.74 104.22.195.95 - - [12/Nov/2026:13:22:49 -0300] "GET /wp-admin/images/admin.php HTTP/1.1" 404 414
20.65.93.74 104.22.195.95 - - [12/Nov/2026:13:22:49 -0300] "GET /adminfuns.php HTTP/1.1" 404 414
show less
Bad Web Bot
2026-11-13 16:10:18
UTC ·
(14 hours ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: WordPress scanning, Webshell probing
Bad Web Bot
Web App Attack
🇬🇧
madetotry
2026-11-13 14:46:59
UTC ·
(15 hours ago)
114 HTTP 404 requests probing PHP web-shell paths including /0x.php and /alfa.php.
Hacking
🇫🇷
geot
2026-11-13 14:25:37
UTC ·
(15 hours ago)
GET /.well-known/acme-challenge/index.php HTTP/1.1
GET /.well-known/ HTTP/1.1
Hacking
Web App Attack
🇵🇱
ketovoila.pl
2026-11-13 13:34:08
UTC ·
(16 hours ago)
Automated WordPress directory enumeration and exposed-file discovery. The source systematically probed WordPress administration, core and content directories, indicating an attempt to identify directory indexing, installed components, writable locati ...
show more
Automated WordPress directory enumeration and exposed-file discovery. The source systematically probed WordPress administration, core and content directories, indicating an attempt to identify directory indexing, installed components, writable locations and exposed files. Attempts: 11; unique paths: 11; WordPress directories: 11; areas: wp-admin,wp-content,wp-includes; helper directories: 0; paths: /wp-includes/block-supports/,/wp-admin/css/,/wp-includes/js/,/wp-admin/css/colors/,/wp-includes/html-api/,/wp-includes/images/,/wp-admin/js/,/wp-content/cache/,/wp-includes/,/wp-includes/pomo/; unique User-Agents: 1; User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"; time range: 2026-11-13T13:34:08Z - 2026-11-13T13:34:23Z. HTTP methods: GET (58).
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
deskpass.com
2026-11-13 13:20:01
UTC ·
(17 hours ago)
GET /classwithtostring.phpl',
Web App Attack
2026-11-13 13:19:53
UTC ·
(17 hours ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇸🇬
Cloudkul Cloudkul
2026-11-13 12:54:20
UTC ·
(17 hours ago)
Attempted Brute Force on our application
Brute-Force
Web App Attack
🇺🇸
Hazael
2026-11-13 12:51:48
UTC ·
(17 hours ago)
SNOOPING - intended to probe for or exploit website vulnerabilities. From: Boydton, États Unis - Microsoft Corporation (AS8075 Microsoft Corporation) - Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131 ...
show more
SNOOPING - intended to probe for or exploit website vulnerabilities. From: Boydton, États Unis - Microsoft Corporation (AS8075 Microsoft Corporation) - Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
show less
Web App Attack
2026-11-13 12:49:04
UTC ·
(17 hours ago)
Web App Attack
Brute-Force
Web App Attack
🇻🇮
Axel
2026-11-13 12:46:32
UTC ·
(17 hours ago)
WAF/ModSecurity blocked 46 malicious request(s) (HTTP 403) from this IP. Activity: request_uri: Wordpress - prevent PHP files from executing x24; Wordpress - Malware x10; request_uri: Images folder - prevent PHP files from executing x3; PHP Command S ...
show more
WAF/ModSecurity blocked 46 malicious request(s) (HTTP 403) from this IP. Activity: request_uri: Wordpress - prevent PHP files from executing x24; Wordpress - Malware x10; request_uri: Images folder - prevent PHP files from executing x3; PHP Command Shell (WSO) x3; request_uri: CSS - prevent PHP files from executing x2; request_uri: Fonts folder - prevent PHP files from executing x1; alfa-rex PHP file pattern - Malware x1; Wordpress - xmlrpc.php accept only POST requests x1; PHP Command Shell x1. Latest: 2026-11-13T12:46:32Z.
show less
Hacking
Brute-Force
Web App Attack
🇺🇦
Infocom
2026-11-13 12:37:01
UTC ·
(17 hours ago)
HTTP_Brute-Force
Brute-Force
🇺🇸
ipblock.com
2026-11-13 12:37:00
UTC ·
(17 hours ago)
IPBlock protected site ID [4055-d][s=07].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
🇩🇰
floyd_dk
2026-11-13 12:34:23
UTC ·
(17 hours ago)
20.65.93.74 - - [13/Nov/2026:12:34:21 +0000] "GET /wp-includes/style-engine/about.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
20.65.93.74 - - [13/Nov/2026: ...
show more
20.65.93.74 - - [13/Nov/2026:12:34:21 +0000] "GET /wp-includes/style-engine/about.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
20.65.93.74 - - [13/Nov/2026:12:34:21 +0000] "GET /wp-includes/rest-api/about.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
20.65.93.74 - - [13/Nov/2026:12:34:21 +0000] "GET /wp-content/banners/about.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
20.65.93.74 - - [13/Nov/2026:12:34:21 +0000] "GET /wp-content/about.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
20.65.93.74 - - [13/Nov/2026:12:34:22 +0000] "GET /.well-known/about.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) App
...
show less
Web App Attack
🇬🇧
consul.to
2026-11-13 12:30:06
UTC ·
(17 hours ago)
Web attack/malicious scanning detected
Web App Attack
