🇩🇪
ger-stg-sifi1
2026-10-12 11:08:15
(2 days ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
neckaralb-admin.de
2026-10-12 11:06:57
(2 days ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 01:28:58
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:6180:100:d0::1a11:a001 (Unknown): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:6180:100:d0::1a11:a001 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 21:28:50.574389 2026] [security2:error] [pid 11076:tid 11076] [client 2400:6180:100:d0::1a11:a001:59322] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cyber-matrix.org.ieas.org"] [uri "/.env.txt"] [unique_id "asw30tMWX25TRWoHmaHwtAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 00:13:12
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:6180:100:d0::1a11:a001 (Unknown): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:6180:100:d0::1a11:a001 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 20:13:05.971934 2026] [security2:error] [pid 26711:tid 26711] [client 2400:6180:100:d0::1a11:a001:59714] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "heatherweathers.com"] [uri "/.env.swp"] [unique_id "aswmEfC8SOmzrbAiWOoHOwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-12 00:11:37
(3 days ago)
[ti-11al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-11al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 2400:6180:100:d0::1a11:a001 - - [12/Oct/2026:02:11:15 +0200] "GET /.env.txt HTTP/1.1" 301 425 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 11:38:15
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:6180:100:d0::1a11:a001 (Unknown): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:6180:100:d0::1a11:a001 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 07:38:10.780675 2026] [security2:error] [pid 18896:tid 18988] [client 2400:6180:100:d0::1a11:a001:39532] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.coheteverde.com.emehache.net"] [uri "/.env.txt"] [unique_id "ast1InhXORFgUqBQTc0ZtwAAAZc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
Klaverstyn
2026-10-11 05:24:06
(3 days ago)
Excessive HTTP request rate
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 04:38:29
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 2400:6180:100:d0::1a11:a001 (Unknown): 1 in the ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:6180:100:d0::1a11:a001 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 00:38:25.146841 2026] [security2:error] [pid 24107:tid 24107] [client 2400:6180:100:d0::1a11:a001:52932] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.cae3.larryyang.net|F|2"] [data ".env.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.cae3.larryyang.net"] [uri "/.env.old"] [unique_id "assSwYyXN7US8WYmld5b4QAAADk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 11:29:40
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:6180:100:d0::1a11:a001 (Unknown): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:6180:100:d0::1a11:a001 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 07:29:35.054452 2026] [security2:error] [pid 15188:tid 15188] [client 2400:6180:100:d0::1a11:a001:60846] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.ixd.net"] [uri "/.env.txt"] [unique_id "asohn1vioqmXEcfN1b3a1AAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 08:32:54
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:6180:100:d0::1a11:a001 (Unknown): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:6180:100:d0::1a11:a001 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 04:32:49.059420 2026] [security2:error] [pid 28006:tid 28006] [client 2400:6180:100:d0::1a11:a001:44010] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "okeetokee.okeetokee.org"] [uri "/.env.txt"] [unique_id "asn4MQ0qtKTwWDy5isJSsQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ZeroTrustSentinel
2026-10-09 17:11:42
(5 days ago)
Hostile connection attempts and automated attack probe (honeypot-tripwire) detected and blocked.
Hacking
Brute-Force
🇩🇪
IVski.com
2026-10-09 00:29:39
(6 days ago)
IVski WAF | Metabase CVE-2026-72898 probe - querying /api/session/properties
Hacking
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-10-08 01:12:12
(6 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: status.astropot.store | URI: /.env.txt | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇫🇷
ELYAZ
2026-10-08 00:41:15
(6 days ago)
(y3) Failed access -byebye- from 2400:6180:100:d0::1a11:a001 (Unknown): (CF_ENABLE)
Hacking
🇳🇱
homeshowdomain.nl
2026-10-07 21:59:22
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-06.
show less
Web App Attack
SSH
Hacking
