🇲🇹
Malta
2026-05-31 06:18:50
(1 week ago)
216.26.227.184 - - [31/May/2026:08:18:50 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ubu ...
show more
216.26.227.184 - - [31/May/2026:08:18:50 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
show less
Hacking
Web App Attack
🇺🇸
cwytech
2026-05-30 10:42:42
(1 week ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/tpot-web-high.
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-05-27 05:27:16
(2 weeks ago)
[WedMay2707:27:12.5941332026][security2:error][pid2616789:tid2616905][client216.26.227.184:0]ModSecu ...
show more
[WedMay2707:27:12.5941332026][security2:error][pid2616789:tid2616905][client216.26.227.184:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"feldenkraistherapy.ch\"][uri\"/wp-login.php\"][unique_id\"ahaAsPz-AFcRun_rxlPKrQAAANM\"]\,referer:https://feldenkraistherapy.ch/wp-login.php
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
lostswordfish.com
2026-05-23 10:42:04
(2 weeks ago)
Wordfence waf block on jestrellafoundation
Web App Attack
🇩🇪
Lino Project
2026-04-11 08:20:53
(2 months ago)
216.26.227.184 - - [11/Apr/2026:10:20:52 +0200] "GET /wp-admin/edit.php?post_type=page HTTP/2.0" 403 ...
show more
216.26.227.184 - - [11/Apr/2026:10:20:52 +0200] "GET /wp-admin/edit.php?post_type=page HTTP/2.0" 403 2556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.207 Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-03-03 19:25:10
(3 months ago)
XMLRPC BRUTEFORCE - HTTP (Request)
Hacking
🇺🇸
TPI-Abuse
2025-12-28 00:58:44
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.227.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.227.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 19:58:38.423690 2025] [security2:error] [pid 3580218:tid 3580218] [client 216.26.227.184:12843] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mdivietnam.com"] [uri "/.svn/wc.db"] [unique_id "aVCAvuRcbC0krapqQh4TmQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-27 22:30:00
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.227.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.227.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 17:29:55.685644 2025] [security2:error] [pid 605865:tid 605933] [client 216.26.227.184:52461] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cwminstitute.com"] [uri "/.svn/wc.db"] [unique_id "aVBd494BE-HbukkenTotbgAAAQs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-27 21:43:42
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.227.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.227.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 16:43:37.601779 2025] [security2:error] [pid 12035:tid 12035] [client 216.26.227.184:51413] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oceanicpier.com"] [uri "/.env"] [unique_id "aVBTCfKq1QxOp7sOPKckngAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-27 20:45:14
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.227.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.227.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 15:45:06.507664 2025] [security2:error] [pid 16763:tid 16763] [client 216.26.227.184:32647] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jatglobalsolution.com"] [uri "/.svn/wc.db"] [unique_id "aVBFUqLLktCpq0E9VNoJhQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-27 16:53:23
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.227.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.227.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 11:53:19.682553 2025] [security2:error] [pid 8475:tid 8475] [client 216.26.227.184:22879] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vincentmonaco.com"] [uri "/.env"] [unique_id "aVAO_5O5Qyc7d0xnMCDxGwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-12-26 05:20:18
(5 months ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-12-26 03:57:13
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.227.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.227.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 25 22:57:06.299339 2025] [security2:error] [pid 30484:tid 30484] [client 216.26.227.184:34437] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.lazymanvegan.com"] [uri "/.svn/wc.db"] [unique_id "aU4Hki6BkQklk7NEcQJFDgAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
iNetWorker
2025-12-26 03:30:24
(5 months ago)
trolling for resource vulnerabilities
Web App Attack
2025-12-02 15:19:42
(6 months ago)
botnet
DDoS Attack