🇺🇸
nodepile
2026-06-11 07:38:38
(1 week ago)
Repeatedly blocked bad web bot (tenant=82 method=GET path=/wp-content/plugins/hello-wps/index.php ua ...
show more
Repeatedly blocked bad web bot (tenant=82 method=GET path=/wp-content/plugins/hello-wps/index.php ua='python-requests/2.34.2')
show less
Bad Web Bot
🇫🇷
Octopuce
2026-06-09 04:52:01
(1 week ago)
Aggressive web search of vulnerable pages: /.well-known/acme-challenge/install.php /.well-known/acme ...
show more
Aggressive web search of vulnerable pages: /.well-known/acme-challenge/install.php /.well-known/acme-challenge/plugins.php /.well-known/acme-ch ...
show less
Web App Attack
2026-06-08 08:43:41
(1 week ago)
203.159.81.50 - - [08/Jun/2026:10:40:23 +0200] "GET /bless.php HTTP/1.1" 404 476 "-" "Mozilla/5.0 (W ...
show more
203.159.81.50 - - [08/Jun/2026:10:40:23 +0200] "GET /bless.php HTTP/1.1" 404 476 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36"
203.159.81.50 - - [08/Jun/2026:10:40:23 +0200] "GET /O-Simple.php HTTP/1.1" 404 476 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0"
203.159.81.50 - - [08/Jun/2026:10:40:23 +0200] "GET /lock360.php HTTP/1.1" 404 476 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"
203.159.81.50 - - [08/Jun/2026:10:40:23 +0200] "GET /zwso.php HTTP/1.1" 404 476 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 OPR/70.0.3728.95"
203.159.81.50 - - [08/Jun/2026:10:40:24 +0200] "GET /chosen.php HTTP/1.1" 404 476 "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36"
203.159.81.50 - - [08/Jun/2026:10:40:24 +0200] "GET /about.php HT
...
show less
DDoS Attack
🇬🇧
Oakley
2026-06-07 03:27:31
(1 week ago)
(mod_security) mod_security (id:900191) triggered by 203.159.81.50 (IL/Israel/-): 5 in the last 900 ...
show more
(mod_security) mod_security (id:900191) triggered by 203.159.81.50 (IL/Israel/-): 5 in the last 900 secs
show less
Web App Attack
Hacking
🇬🇧
consul.to
2026-06-06 20:36:07
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
ValtonTahiri
2026-02-24 22:30:27
(3 months ago)
Honeypot hit: HTTP GET http://[SOME-IP]/.vscode/sftp.json
URL: http://[SOME-IP]/.vscode/sftp.json
Me ...
show more
Honeypot hit: HTTP GET http://[SOME-IP]/.vscode/sftp.json
URL: http://[SOME-IP]/.vscode/sftp.json
Method: GET
Status: 200
User-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Host: [SOME-IP]
Accept: */*
Other Headers: accept-encoding: *, connection: keep-alive
show less
Hacking
Bad Web Bot
🇳🇱
Site.eu
2026-02-24 06:08:54
(3 months ago)
Excessive 404/403 errors
Brute-Force
🇫🇷
dynamix
2026-02-10 15:44:16
(4 months ago)
Multiple WAF Violations
Web App Attack
2026-02-10 00:26:43
(4 months ago)
wordpress-trap
Web App Attack
🇳🇱
Site.eu
2026-01-05 15:16:21
(5 months ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-01-05 03:04:14
(5 months ago)
(mod_security) mod_security (id:240000) triggered by 203.159.81.50 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240000) triggered by 203.159.81.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 22:04:10.296423 2026] [security2:error] [pid 30968:tid 30968] [client 203.159.81.50:32403] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||chubat.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "chubat.com"] [uri "/images/stories/themes.php"] [unique_id "aVsqKp5RWWrYP2qw5wg99wAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
loveprod
2026-01-05 02:29:25
(5 months ago)
203.159.81.50 - - [05/Jan/2026:05:29:17 +0300] "GET /admin.php HTTP/1.1" 301 311 "-" "Mozilla/5.0 (W ...
show more
203.159.81.50 - - [05/Jan/2026:05:29:17 +0300] "GET /admin.php HTTP/1.1" 301 311 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36"
203.159.81.50 - - [05/Jan/2026:05:29:25 +0300] "GET /wp-content/plugins/pwnd/pwnd.php HTTP/1.1" 301 334 "-" "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0"
...
show less
Bad Web Bot
🇩🇪
iNetWorker
2026-01-05 02:07:16
(5 months ago)
trolling for resource vulnerabilities
Web App Attack
🇺🇸
TPI-Abuse
2026-01-04 22:19:09
(5 months ago)
(mod_security) mod_security (id:240000) triggered by 203.159.81.50 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240000) triggered by 203.159.81.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 17:19:04.737425 2026] [security2:error] [pid 4814:tid 4814] [client 203.159.81.50:0] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "87"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||easy-byte.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "easy-byte.net"] [uri "/images/stories/themes.php"] [unique_id "aVrnWHm5G1JCi7i0C5KB1gAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
loadsoporte
2026-01-04 20:58:32
(5 months ago)
RdpGuard detected brute-force attempt on HTTP
Brute-Force