🇨🇿
ddw
2026-09-01 13:02:42
(3 hours ago)
Access Violation Attempts - Multiple 403 Forbidden responses.
Hacking
Bad Web Bot
Web App Attack
🇺🇸
ctidrv
2026-09-01 11:51:50
(4 hours ago)
Honeypot detection. Threat score: 85/100. Collector: wp_login. | Request: POST /wp-login.php | Crede ...
show more
Honeypot detection. Threat score: 85/100. Collector: wp_login. | Request: POST /wp-login.php | Credentials captured: user=yanz@123457 | UA: Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 | rDNS: 216.26.253.85 | Reasons: wp_login_probe, wp_credentials_submitted
show less
Brute-Force
Bad Web Bot
🇫🇷
Sklurk
2026-07-30 01:08:10
(1 month ago)
Web App Attack
Web App Attack
2026-07-09 13:10:53
(1 month ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
🇫🇷
Sklurk
2026-07-08 00:24:39
(1 month ago)
Web App Attack
Web App Attack
🇩🇪
Carsten
2026-06-14 14:33:39
(2 months ago)
GET [sql/dump.sql]
Port Scan
🇩🇪
FeG Deutschland
2026-06-12 07:15:46
(2 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇩🇪
FeG Deutschland
2026-04-24 00:49:30
(4 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 08:45:12
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.253.85 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.253.85 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 03:45:05.130037 2025] [security2:error] [pid 1709:tid 1709] [client 216.26.253.85:56851] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.texasbordertours.com.worldchat.global"] [uri "/.env"] [unique_id "aSa-EdZn2O9tUSTvmyxoNgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 07:06:53
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.253.85 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.253.85 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 02:06:49.490843 2025] [security2:error] [pid 7721:tid 7721] [client 216.26.253.85:17323] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.ohioaci.org"] [uri "/.env"] [unique_id "aSanCbJqDGtfcRy71igg4gAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 01:30:03
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.253.85 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.253.85 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 20:29:56.974822 2025] [security2:error] [pid 13362:tid 13362] [client 216.26.253.85:30077] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rohan.byles.net"] [uri "/.svn/wc.db"] [unique_id "aSZYFIbAmOEjjTbLiMXY6wAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 01:00:35
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.253.85 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.253.85 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 20:00:27.637305 2025] [security2:error] [pid 6650:tid 6650] [client 216.26.253.85:59501] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.lejzerowicz.org"] [uri "/.env"] [unique_id "aSZRK3XSL_FnCoqUJ8bdjwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
NXTwoThou
2025-11-24 18:02:18
(9 months ago)
/.git/HEAD
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 08:43:30
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.253.85 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.253.85 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 03:43:17.991498 2025] [security2:error] [pid 3632411:tid 3632411] [client 216.26.253.85:56109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.sra-ep.com"] [uri "/.env"] [unique_id "aSQapQTN8j3FK6SWWUYpNgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-14 14:49:03
(9 months ago)
This IP was involved in an brute force and password spray attack on 2025/11/14 08:46:57
Port Scan
Brute-Force
Exploited Host
Web App Attack