🇺🇸
TPI-Abuse
2026-10-21 20:03:36
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 2001:ac8:20:225:1ed4:8a35:6878:7fab (Unknown): ...
show more
(mod_security) mod_security (id:210730) triggered by 2001:ac8:20:225:1ed4:8a35:6878:7fab (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:03:28.793485 2026] [security2:error] [pid 14105:tid 14811] [client 2001:ac8:20:225:1ed4:8a35:6878:7fab:45934] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||whatismetamodern.com|F|2"] [data ".php.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "whatismetamodern.com"] [uri "/wp-config.php.OLD"] [unique_id "atkakOu4QT2lhnZeL8kA-wAAAEU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-21 13:00:34
(1 day ago)
Automated web vulnerability and path enumeration scan with excessive 404 requests
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-10-21 05:15:25
(2 days ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇳🇱
Roderic
2026-10-20 12:09:44
(2 days ago)
Insights: 15 probe requests within 24 hours on 1 site, e.g. /wp-config.php.BAK (no normal page views ...
show more
Insights: 15 probe requests within 24 hours on 1 site, e.g. /wp-config.php.BAK (no normal page views)
show less
Web App Attack
🇩🇪
FD-IX
2026-10-20 09:13:25
(2 days ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 06:39:14
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2001:ac8:20:225:1ed4:8a35:6878:7fab (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:ac8:20:225:1ed4:8a35:6878:7fab (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 02:39:05.457525 2026] [security2:error] [pid 26933:tid 26944] [client 2001:ac8:20:225:1ed4:8a35:6878:7fab:47768] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "minutosrobados.com"] [uri "/.wp-config.php.swp"] [unique_id "atcMifn_GtV6aKqgOdtiyQAAAIg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-03 17:40:48
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 2001:ac8:20:225:1ed4:8a35:6878:7fab (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:ac8:20:225:1ed4:8a35:6878:7fab (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 13:40:42.920128 2026] [security2:error] [pid 4023889:tid 4023889] [client 2001:ac8:20:225:1ed4:8a35:6878:7fab:54328] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "joevallone.com"] [uri "/wp-config.php.dist"] [unique_id "anDSmhPzpBusbm9Syms7uQAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-08-03 06:32:52
(2 months ago)
CrowdSec: crowdsecurity/http-wordpress_wpconfig | req: /.wp-config.php.swp | 6 distinct paths | UA: ...
show more
CrowdSec: crowdsecurity/http-wordpress_wpconfig | req: /.wp-config.php.swp | 6 distinct paths | UA: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
show less
Web App Attack
🇫🇮
stinpriza
2026-08-02 23:19:47
(2 months ago)
Web App Attack
Web App Attack
🇩🇪
FD-IX
2026-08-02 20:41:35
(2 months ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇩🇪
maxpower
2026-08-02 17:11:55
(2 months ago)
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 2001:ac8:20:225:1ed4:8a35:6878:7fab (DE/German ...
show more
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 2001:ac8:20:225:1ed4:8a35:6878:7fab (DE/Germany/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 2026/08/02 19:11:53 [error] 493989#493989: *1415367 access forbidden by rule, client: 2001:ac8:20:225:1ed4:8a35:6878:7fab, server: costruirebene.it, request: "GET /wp-config.php.bak HTTP/1.1", host: "costruirebene.it"
2026/08/02 19:11:53 [error] 493986#493986: *1415368 access forbidden by rule, client: 2001:ac8:20:225:1ed4:8a35:6878:7fab, server: costruirebene.it, request: "GET /wp-config.php.old HTTP/1.1", host: "costruirebene.it"
2026/08/02 19:11:53 [error] 493984#493984: *1415369 access forbidden by rule, client: 2001:ac8:20:225:1ed4:8a35:6878:7fab, server: costruirebene.it, request: "GET /wp-config.php_orig HTTP/1.1", host: "costruirebene.it"
show less
Port Scan
🇩🇪
LRob
2026-08-02 08:29:35
(2 months ago)
CrowdSec: crowdsecurity/http-probing | req: /.wp-config.php.swp | 11 distinct paths | UA: Mozilla/5. ...
show more
CrowdSec: crowdsecurity/http-probing | req: /.wp-config.php.swp | 11 distinct paths | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.7 Safari/537.36
show less
Port Scan
Web App Attack
🇳🇱
e.fierstra
2026-08-02 06:56:13
(2 months ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-02 06:21:09
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 2001:ac8:20:225:1ed4:8a35:6878:7fab (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:ac8:20:225:1ed4:8a35:6878:7fab (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 02 02:20:59.664136 2026] [security2:error] [pid 912114:tid 912114] [client 2001:ac8:20:225:1ed4:8a35:6878:7fab:36772] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "barigby.com"] [uri "/wp-config.php~"] [unique_id "am7hy0bViYReN4YGKbsuGAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-02 03:47:52
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 2001:ac8:20:225:1ed4:8a35:6878:7fab (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:ac8:20:225:1ed4:8a35:6878:7fab (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 23:47:47.740940 2026] [security2:error] [pid 2526620:tid 2526620] [client 2001:ac8:20:225:1ed4:8a35:6878:7fab:39210] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.txt" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "art.mavikalem.org"] [uri "/wp-config.txt"] [unique_id "am6943874GoCLWMPaqGDJgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack