🇳🇱
WeCloudit-Anti-Abuse
2026-10-12 04:37:26
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇬🇧
openstrike.co.uk
2026-10-11 05:14:20
(1 week ago)
8 attacks on PHP URLs:
POST /WeGIA/html/login.php HTTP/1.1
Web App Attack
🇩🇪
big-cloud.nl
2026-10-11 01:10:20
(1 week ago)
Try to access /wp-content/plugins/quick-playground/readme.txt
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 06:56:11
(1 week ago)
(mod_security) mod_security (id:211190) triggered by 2400:6180:0:d2:0:3:38ba:7000 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:211190) triggered by 2400:6180:0:d2:0:3:38ba:7000 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 02:56:07.348205 2026] [security2:error] [pid 23894:tid 24027] [client 2400:6180:0:d2:0:3:38ba:7000:49386] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||whatismetamodern.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /images/index.html?id=%24%7B%40print_r%28%40system%28%22cat+/etc/passwd%22%29%29%7D"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whatismetamodern.com"] [uri "/images/index.html"] [unique_id "asnhhzoDhQe18wl6eAOs8QAAAVI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 05:37:52
(1 week ago)
(mod_security) mod_security (id:211190) triggered by 2400:6180:0:d2:0:3:38ba:7000 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:211190) triggered by 2400:6180:0:d2:0:3:38ba:7000 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 01:37:39.699642 2026] [security2:error] [pid 3290:tid 3290] [client 2400:6180:0:d2:0:3:38ba:7000:60772] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||sangalgano.info|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /images/index.html?id=%24%7B%40print_r%28%40system%28%22cat+/etc/passwd%22%29%29%7D"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sangalgano.info"] [uri "/images/index.html"] [unique_id "asnPI_rIjQi1JlmddG2__AAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
roxyapi
2026-10-10 05:33:36
(1 week ago)
Honeypot: automated vulnerability scan / web app attack. Last probe: POST /web/cgi-bin/usbinteract.c ...
show more
Honeypot: automated vulnerability scan / web app attack. Last probe: POST /web/cgi-bin/usbinteract.cgi
show less
Web App Attack
Bad Web Bot
🇩🇪
on-com
2026-10-10 05:00:11
(1 week ago)
URL scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 04:45:51
(1 week ago)
(mod_security) mod_security (id:211190) triggered by 2400:6180:0:d2:0:3:38ba:7000 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:211190) triggered by 2400:6180:0:d2:0:3:38ba:7000 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 00:45:47.780448 2026] [security2:error] [pid 30026:tid 30026] [client 2400:6180:0:d2:0:3:38ba:7000:33632] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||mwrn.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /images/index.html?id=%24%7B%40print_r%28%40system%28%22cat+/etc/passwd%22%29%29%7D"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mwrn.com"] [uri "/images/index.html"] [unique_id "asnC-_XJLxmafQBy7yEFeAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-10 04:37:54
(1 week ago)
[cb-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: - - [10/Oct/2026:06:37:33 +0200] "GET /images/index.html?id=%24%7B%40print_r%28%40system%28%22cat+/etc/passwd%22%29%29%7D HTTP/2.0" 404 20442 "-" "Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 04:23:31
(1 week ago)
(mod_security) mod_security (id:211190) triggered by 2400:6180:0:d2:0:3:38ba:7000 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:211190) triggered by 2400:6180:0:d2:0:3:38ba:7000 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 00:23:23.717524 2026] [security2:error] [pid 17722:tid 17722] [client 2400:6180:0:d2:0:3:38ba:7000:38486] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||lusineweb.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /images/index.html?id=%24%7B%40print_r%28%40system%28%22cat+/etc/passwd%22%29%29%7D"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lusineweb.com"] [uri "/images/index.html"] [unique_id "asm9u_th1Lre7-OKvhsEhwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-10-10 02:55:57
(1 week ago)
excessive HTTP 404 errors
Bad Web Bot
🇧🇪
cmbplf
2026-10-10 02:41:43
(1 week ago)
228 requests with url.path *config.php
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-10 02:00:44
(1 week ago)
(mod_security) mod_security (id:211190) triggered by 2400:6180:0:d2:0:3:38ba:7000 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:211190) triggered by 2400:6180:0:d2:0:3:38ba:7000 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 22:00:34.428987 2026] [security2:error] [pid 30455:tid 30479] [client 2400:6180:0:d2:0:3:38ba:7000:44460] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||certifiedprojectmanager.us|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /images/index.html?id=%24%7B%40print_r%28%40system%28%22cat+/etc/passwd%22%29%29%7D"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "certifiedprojectmanager.us"] [uri "/images/index.html"] [unique_id "asmcQtI_JSYKmChlCax_fgAAAFU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Major Hostility
2026-10-10 01:23:05
(1 week ago)
"POST /api/v1/validate/code HTTP/1.1" 404
"GET /helpdesk/WebObjects/Helpdesk.woa HTTP/1.1" 404
"POST ...
show more
"POST /api/v1/validate/code HTTP/1.1" 404
"GET /helpdesk/WebObjects/Helpdesk.woa HTTP/1.1" 404
"POST /web/cgi-bin/usbinteract.cgi HTTP/1.1" 404
show less
Web App Attack
