🇨🇿
ddw
2026-10-11 23:18:39
(16 hours ago)
WordPress Brute Force Attack.
Hacking
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-10-10 09:24:01
(2 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cpanel.teddypot.cloud | URI: /.ssh/id_rsa | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Hacking
Web App Attack
🇫🇷
ELYAZ
2026-10-07 22:19:08
(4 days ago)
(wordpress) Failed wordpress login from 216.26.241.66 (BR/Brazil/-): (CF_ENABLE)
Brute-Force
2026-10-07 20:01:43
(4 days ago)
2026-10-07T20:01:42.573986+00:00 instance-20260804-1025 wordpress(expensas.co)[509392]: XML-RPC auth ...
show more
2026-10-07T20:01:42.573986+00:00 instance-20260804-1025 wordpress(expensas.co)[509392]: XML-RPC authentication attempt for unknown user wefcakmi from 216.26.241.66
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-11-27 14:08:43
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 09:08:38.132014 2025] [security2:error] [pid 25993:tid 25993] [client 216.26.241.66:20797] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.yarbro.org"] [uri "/.svn/wc.db"] [unique_id "aShbZh1QqCfkUP4haI6N6AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-27 11:22:22
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 06:22:18.341530 2025] [security2:error] [pid 7586:tid 7586] [client 216.26.241.66:34611] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.thejuliataylor.ingberinteriors.com"] [uri "/.svn/wc.db"] [unique_id "aSg0astuiz0hrfDmreeiigAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-27 09:29:41
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 04:29:35.908714 2025] [security2:error] [pid 8452:tid 8452] [client 216.26.241.66:48999] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rahjx.net"] [uri "/.svn/wc.db"] [unique_id "aSgZ_1P-CWKNyYoeDHEX6gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-27 05:01:46
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 00:01:42.477408 2025] [security2:error] [pid 13403:tid 13403] [client 216.26.241.66:38133] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kemblebrother.kemblebrothers.com"] [uri "/.git/HEAD"] [unique_id "aSfbNlRkfo0PxNjZWsOoswAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 07:05:12
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 02:05:06.226329 2025] [security2:error] [pid 25554:tid 25554] [client 216.26.241.66:56993] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.debhill.com"] [uri "/.svn/wc.db"] [unique_id "aSVVIpB3mY-_UqSbgBnuTQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 06:20:12
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 01:19:58.929726 2025] [security2:error] [pid 908452:tid 908452] [client 216.26.241.66:57215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.nielectricalsales.com"] [uri "/.svn/wc.db"] [unique_id "aSVKjtQTfk48gs8fwzZZiQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 05:05:09
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:05:02.542464 2025] [security2:error] [pid 15835:tid 15835] [client 216.26.241.66:20051] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.lopansri.com"] [uri "/.env"] [unique_id "aSU4_jQoMGyvB-FDkcafFgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 04:24:09
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:24:05.421050 2025] [security2:error] [pid 1816810:tid 1816965] [client 216.26.241.66:42333] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "houstonplasticsurgeontexas.com.aafm.us"] [uri "/.env"] [unique_id "aSUvZZGZcKt2mCqV6A-7KAAAAk8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 03:35:46
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:35:40.068214 2025] [security2:error] [pid 30214:tid 30214] [client 216.26.241.66:41149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.desertvacationvillas.com"] [uri "/.svn/wc.db"] [unique_id "aSUkDIO_Ls_Mei31Wjun9QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 03:17:52
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:17:45.974486 2025] [security2:error] [pid 26002:tid 26002] [client 216.26.241.66:48609] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nef.jamesallenwalker.com"] [uri "/.git/HEAD"] [unique_id "aSUf2fGq-fUeAvOR5W1gMwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 01:21:55
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.241.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 20:21:52.471496 2025] [security2:error] [pid 20445:tid 20445] [client 216.26.241.66:28379] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.cestcaryntravel.com"] [uri "/.git/HEAD"] [unique_id "aSUEsLjKIDq5H8bqPfsyvQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
