🇺🇸
drewf.ink
2026-09-29 11:40:39
UTC ·
(1 month ago)
[11:40] Attempted HTTPS GlobalProtect login with credentials morrisr:W******1
Web App Attack
🇩🇪
jocurionline
2026-09-29 01:30:22
UTC ·
(1 month ago)
Auto-blocked by WAF: AUTO-BAN: SecurityGuard: sqli x1 1 h
Web App Attack
SQL Injection
🇺🇸
drewf.ink
2026-09-29 01:18:39
UTC ·
(1 month ago)
[01:18] Attempted HTTPS GlobalProtect config retrieval with credentials jsanders:Pa*****d1 (getconfig.esp - some brute-force tooling targets this directly instead of login.esp)
Web App Attack
🇫🇷
fineservice
2026-09-25 04:39:08
UTC ·
(1 month ago)
PrestaShop Security Module: SQL injection probe detected
Web App Attack
🇺🇦
URAN Publishing Service
2026-09-24 05:17:12
UTC ·
(1 month ago)
SQLi Attempt
Hacking
SQL Injection
Web App Attack
🇫🇷
Sklurk
2026-09-11 06:27:49
UTC ·
(1 month ago)
Web App Attack
Web App Attack
🇺🇸
drewf.ink
2026-09-04 09:43:20
UTC ·
(2 months ago)
[09:43] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon)
Web App Attack
🇩🇪
LRob
2026-06-24 01:32:51
UTC ·
(4 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇫🇮
inlink.ltd
2026-05-19 22:13:06
UTC ·
(5 months ago)
Known malicious PHP file or CMS probe
Web App Attack
🇩🇪
Packets-Decreaser.NET
2025-12-29 14:01:06
UTC ·
(10 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
TPI-Abuse
2025-11-26 04:16:12
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 23:16:07.443371 2025] [security2:error] [pid 13111:tid 13160] [client 216.26.241.161:44105] ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 23:16:07.443371 2025] [security2:error] [pid 13111:tid 13160] [client 216.26.241.161:44105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "barnettbusinessgroup.mailporte.com"] [uri "/.git/HEAD"] [unique_id "aSZ_Byv-PRieONCNNDIHJAAAAU8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 00:51:26
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 19:51:21.313306 2025] [security2:error] [pid 27838:tid 27838] [client 216.26.241.161:58017] ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 19:51:21.313306 2025] [security2:error] [pid 27838:tid 27838] [client 216.26.241.161:58017] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.nflelectronics.com"] [uri "/.env"] [unique_id "aSZPCcJiRBcWu40tNMPxMQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 00:06:55
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 19:06:49.682865 2025] [security2:error] [pid 28347:tid 28347] [client 216.26.241.161:50219] ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 19:06:49.682865 2025] [security2:error] [pid 28347:tid 28347] [client 216.26.241.161:50219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.markshvarts.com"] [uri "/.svn/wc.db"] [unique_id "aSZEmfOYyU77FJQTdYdAZAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-24 09:54:09
UTC ·
(11 months ago)
Attempted access to sensitive endpoint (/.git/HEAD) detected. Automated scan or unauthorized probing.
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 06:52:28
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 01:52:22.921936 2025] [security2:error] [pid 1552:tid 1552] [client 216.26.241.161:40423] M ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 01:52:22.921936 2025] [security2:error] [pid 1552:tid 1552] [client 216.26.241.161:40423] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.ken-hensley.com"] [uri "/.svn/wc.db"] [unique_id "aSQApksGa589svNdOtVw8QAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
