🇩🇪
4server
2026-11-09 11:21:08
UTC ·
(1 hour ago)
[MonNov0912:21:06.4528882026][security2:error][pid1252056:tid1252155][client201.165.138.130:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\|finite\)\|n\(\?:u\(\?:meric\|ll\)\ ...
show more
[MonNov0912:21:06.4528882026][security2:error][pid1252056:tid1252155][client201.165.138.130:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\|finite\)\|n\(\?:u\(\?:meric\|ll\)\|an\)\|\(\?:calla\|dou\)ble\|s\(\?:calar\|tring\)\|f\(\?:inite\|loat\)\|re\(\?:source\|al\)\|l\(\?:ink\|ong\)\|a\(\?:rray\)\?\|object\|bool\)\|set\)\|n\(\?:\(\?:clud\|vok\)e\|t\(\?:div\|val\)\)\|\(\?:mplod\|dat\)e\|conv\)\|s\(\?:t\(\?:r\(\?:\(\?:le\|sp\)n\|...\"atREQUEST_COOKIES:4d5d155d508a4a358e8ec19b16a4af51.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"582\"][id\"380026\"][rev\"27\"][msg\"Atomicorp.comWAFRules:PHPpayloaddetected\"][data\"echo\(4579\*1519\)\"][severity\"CRITICAL\"][tag\"SQLi\"][tag\"RCE\"][hostname\"cpfacilityservices.ch\"][uri\"/wp-content/themes/twentytwentyfive/functions.php\"][unique_id\"avGsojgy3QYgT5twiHZHTgAAAMo\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-11-09 10:54:34
UTC ·
(1 hour ago)
Web shell access (POST to a PHP file in wp-includes or wp-content/uploads)
Hacking
Web App Attack
🇩🇪
todix
2026-11-09 03:22:20
UTC ·
(9 hours ago)
"POST /wp-includes/lufix.php HTTP/1.1" 403 1026 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0"
Web App Attack
🇿🇦
conure.sh
2026-11-08 23:10:00
UTC ·
(13 hours ago)
csagent: score 27.3: webshell name x2, wp plugin/theme 404 x2, php 404 x2; 2 domain(s) in 2s
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 18:21:44
UTC ·
(18 hours ago)
(mod_security) mod_security (id:210410) triggered by 201.165.138.130 (customer-GDL-MCA-138-130.megared.net.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:21:40.092188 2026] [security2:error] [pid 11159:t ...
show more
(mod_security) mod_security (id:210410) triggered by 201.165.138.130 (customer-GDL-MCA-138-130.megared.net.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:21:40.092188 2026] [security2:error] [pid 11159:tid 11159] [client 201.165.138.130:14457] ModSecurity: Access denied with code 403 (phase 2). Found 1 byte(s) in REQUEST_HEADERS:Cookie outside range: 1-255. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "95"] [id "210410"] [rev "4"] [msg "COMODO WAF: Invalid character in request||sharawi-gum.com|F|3"] [data "REQUEST_HEADERS:Cookie=ZkpA=\\xda\\xcbg^\\xb9\\x0f\\x15\\x00\\xed\\x144\\x96\\xff\\x03\\xdew"] [severity "ERROR"] [tag "CWAF"] [tag "Protocol"] [hostname "sharawi-gum.com"] [uri "/wp-admin.php"] [unique_id "avC9tPacmtLsXsCtkcpTrAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Starburst SysOp Team
2026-11-08 13:09:49
UTC ·
(23 hours ago)
Malware host (X-Forwarded-For) detected by rbl.malware.expert. RBL lookup of 130.138.165.201.rbl.malware.expert succeeded at REQUEST_HEADERS:x-forwarded-for. (1001000-mnz6-3)
Hacking
🇩🇪
FeG Deutschland
2026-11-08 08:45:05
UTC ·
(1 day ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14
Exploited Host
Web App Attack
🇳🇱
Site.eu
2026-11-08 02:46:29
UTC ·
(1 day ago)
Web shell access (POST to a PHP file in wp-includes or wp-content/uploads)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 23:06:30
UTC ·
(1 day ago)
(mod_security) mod_security (id:210410) triggered by 201.165.138.130 (customer-GDL-MCA-138-130.megared.net.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:06:24.399135 2026] [security2:error] [pid 25423:t ...
show more
(mod_security) mod_security (id:210410) triggered by 201.165.138.130 (customer-GDL-MCA-138-130.megared.net.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:06:24.399135 2026] [security2:error] [pid 25423:tid 25423] [client 201.165.138.130:44053] ModSecurity: Access denied with code 403 (phase 2). Found 1 byte(s) in REQUEST_HEADERS:Cookie outside range: 1-255. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "95"] [id "210410"] [rev "4"] [msg "COMODO WAF: Invalid character in request||eatcakecup.com|F|3"] [data "REQUEST_HEADERS:Cookie=hvHi=\\x8f\\x8e\\x98\\xc2\\xaa\\x06\\xbf\\x9f-\\xe7\\x00\\xdf\\xbd\\xa3 \\x8b"] [severity "ERROR"] [tag "CWAF"] [tag "Protocol"] [hostname "eatcakecup.com"] [uri "/wp-author.php"] [unique_id "au-u8Pq7OdBaAR4HZv9OqwAAACw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
dtorrer
2026-11-07 22:25:37
UTC ·
(1 day ago)
Attacks on known web applications vulnerabilities.
Web App Attack
🇺🇸
mnsf
2026-11-07 15:05:13
UTC ·
(1 day ago)
Too many Status 40X (12)
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-11-07 12:26:59
UTC ·
(1 day ago)
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 201.165.138.130 - - [07/Nov/2026:13:26:54 +0100] "POST /wp-content/plugins/WP-FormBuilder/admin/alfa.php HTTP/1.1" 301 6126 "-" "Mozilla/5.0 (Win ...
show more
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 201.165.138.130 - - [07/Nov/2026:13:26:54 +0100] "POST /wp-content/plugins/WP-FormBuilder/admin/alfa.php HTTP/1.1" 301 6126 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
francelink.fr
2026-11-07 09:37:24
UTC ·
(2 days ago)
Azure WAF blocked a request. Rule: 100200. Observed at: 2026-11-07T09:35:38.000Z.
Web App Attack
🇩🇪
LRob
2026-11-07 06:01:19
UTC ·
(2 days ago)
Web shell probe | method: POST | path: /wp-content/plugins/mystickyelements/connents.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 04:24:53
UTC ·
(2 days ago)
(mod_security) mod_security (id:210410) triggered by 201.165.138.130 (customer-GDL-MCA-138-130.megared.net.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 23:24:46.421518 2026] [security2:error] [pid 4620:ti ...
show more
(mod_security) mod_security (id:210410) triggered by 201.165.138.130 (customer-GDL-MCA-138-130.megared.net.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 23:24:46.421518 2026] [security2:error] [pid 4620:tid 4632] [client 201.165.138.130:41742] ModSecurity: Access denied with code 403 (phase 2). Found 1 byte(s) in REQUEST_HEADERS:Cookie outside range: 1-255. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "95"] [id "210410"] [rev "4"] [msg "COMODO WAF: Invalid character in request||www.asetiadi.net|F|3"] [data "REQUEST_HEADERS:Cookie=hvHi=\\x8f\\x8e\\x98\\xc2\\xaa\\x06\\xbf\\x9f+\\xe7\\x00\\xd0\\xbc\\xa5 \\x8b"] [severity "ERROR"] [tag "CWAF"] [tag "Protocol"] [hostname "www.asetiadi.net"] [uri "/wp-author.php"] [unique_id "au6oDnVLAGYtvhn8ytwCVgAAAMo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
