🇫🇷
Kenshin869
2025-09-16 04:59:18
(1 year ago)
Wordpress unauthorized access attempt
Brute-Force
2025-09-15 14:35:06
(1 year ago)
Failed login attempt detected by Fail2Ban in plesk-wordpress jail
Exploited Host
2025-09-15 08:20:08
(1 year ago)
(wordpress) Failed wordpress login from 216.73.161.36 (US/United States/-)
Brute-Force
🇺🇸
octageeks.com
2025-09-15 04:08:03
(1 year ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇪🇸
masterguru
2025-09-15 03:15:42
(1 year ago)
(wplogin) Failed WordPress login from 216.73.161.36 (US/United States/-): 5 in the last 3600 secs (0 ...
show more
(wplogin) Failed WordPress login from 216.73.161.36 (US/United States/-): 5 in the last 3600 secs (0-122)
show less
Hacking
🇪🇸
masterguru
2025-09-15 02:55:47
(1 year ago)
(wplogin) Failed WordPress login from 216.73.161.36 (US/United States/-): 5 in the last 3600 secs (0 ...
show more
(wplogin) Failed WordPress login from 216.73.161.36 (US/United States/-): 5 in the last 3600 secs (0-123)
show less
Hacking
🇺🇸
Jason Howell
2025-09-14 20:18:05
(1 year ago)
216.73.161.36 - - [14/Sep/2025:15:13:04 -0500] "POST //xmlrpc.php HTTP/1.1" 200 3018 "-" "Mozilla/5. ...
show more
216.73.161.36 - - [14/Sep/2025:15:13:04 -0500] "POST //xmlrpc.php HTTP/1.1" 200 3018 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.3124.85"
216.73.161.36 - - [14/Sep/2025:15:13:22 -0500] "POST //xmlrpc.php HTTP/1.1" 200 3016 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15"
216.73.161.36 - - [14/Sep/2025:15:13:35 -0500] "POST //xmlrpc.php HTTP/1.1" 200 3017 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"
216.73.161.36 - - [14/Sep/2025:15:13:35 -0500] "POST //xmlrpc.php HTTP/1.1" 200 3018 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.3124.85"
216.73.161.36 - - [14/Sep/2025:15:18:04 -0500] "POST /wp-login.php HTTP/1.1" 200 6291 "https://www.11thstreetprecinct.com/wp-login.php" "Mozilla/5.0 (Macinto
...
show less
Web App Attack
🇦🇺
MAGIC
2025-04-06 02:11:19
(1 year ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇦🇺
MAGIC
2025-03-30 14:03:14
(1 year ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇵🇱
nfsec.pl
2025-03-27 18:00:29
(1 year ago)
216.73.161.36 - - [27/Mar/2025:18:59:12 +0100] "POST /frontend/.env HTTP/1.1" 403 443 "-" "Mozilla/5 ...
show more
216.73.161.36 - - [27/Mar/2025:18:59:12 +0100] "POST /frontend/.env HTTP/1.1" 403 443 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
216.73.161.36 - - [27/Mar/2025:18:59:36 +0100] "POST /application/server/.env HTTP/1.1" 403 443 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0"
216.73.161.36 - - [27/Mar/2025:19:00:03 +0100] "GET /public_html/.env HTTP/1.1" 403 443 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
216.73.161.36 - - [27/Mar/2025:19:00:04 +0100] "POST /public_html/.env HTTP/1.1" 403 443 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15"
216.73.161.36 - - [27/Mar/2025:19:00:29 +0100] "POST /localhost/.env HTTP/1.1" 403 443 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.
...
show less
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2025-03-27 01:50:28
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 216.73.161.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.73.161.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 26 21:50:21.620321 2025] [security2:error] [pid 14281:tid 14281] [client 216.73.161.36:9173] [client 216.73.161.36] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.115"] [uri "/application/server/.env"] [unique_id "Z-Su3W57wuEGcjHMGcYE2QAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-03-27 01:25:14
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 216.73.161.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.73.161.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 26 21:25:07.038602 2025] [security2:error] [pid 24551:tid 24551] [client 216.73.161.36:14239] [client 216.73.161.36] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.114"] [uri "/www/.env"] [unique_id "Z-So8yMk-S3zozrjlYJMZgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
thefoofighter
2025-03-26 23:25:30
(1 year ago)
[Wed Mar 26 23:25:16.582563 2025] [:error] [pid 1977519] [client 216.73.161.36:39765] [client 216.73 ...
show more
[Wed Mar 26 23:25:16.582563 2025] [:error] [pid 1977519] [client 216.73.161.36:39765] [client 216.73.161.36] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "63.250.44.173"] [uri "/api/source/.env"] [unique_id "Z-SM3CBSgcPLgP33Ni4tIwAAABI"]
[Wed Mar 26 23:25:29.911172 2025] [:error] [pid 1977514] [client 216.73.161.36:11859] [client 216.73.161.36] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_C
...
show less
Bad Web Bot
Web App Attack
🇮🇹
Rosh
2025-03-15 18:19:38
(1 year ago)
[03/15/25 19:19:38] Unauthorized request HTTP/1.1 404 on port 80
Hacking
Web App Attack
🇩🇪
niceshops.com
2025-03-08 07:22:25
(1 year ago)
Web Attack (08/Mar/2025:08:17:59.441", "frontend": "frontend_disco~", "backend": "frontend_disco", " ...
show more
Web Attack (08/Mar/2025:08:17:59.441", "frontend": "frontend_disco~", "backend": "frontend_disco", "backend_server": "<NOSRV>", "time_request": 0, "time_wait": -1, "time_connect": -1, "time_response": -1, "time_active": 0, "status": 425, "bytes_read": 7375, "termination_state": "PR--", "actconn": 104, "feconn": 103, "beconn": 0, "srv_conn": 0, "retries": 0, "srv_queue": 0, "backend_queue": 0, "capture_request": "{46.4.185.227|0|0||0||0|Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0|1||424928a9ef9ab3a76dc1d97553999c48-US-206092-216.73.0.0-00-y-feca--l-x-7067cde5-n-u-x-n-n|y-feca--l-x-x-00000000-c40cb9ee-7067cde5-00000000-bf013e34-n-x-1.1-u-x-x-n-n|424928a9ef9ab3a76dc1d97553999c48||8||1|0|0|unverified|US|206092|0|0}", "capture_response GET /redmine/.env)
show less
Web App Attack