🇩🇪
ger-stg-sifi1
2026-09-29 01:43:29
(2 weeks ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-09-27 14:54:50
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2a02:4780:12:763e::1 (srv1120525.hstgr.cloud): ...
show more
(mod_security) mod_security (id:210492) triggered by 2a02:4780:12:763e::1 (srv1120525.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 27 10:54:43.208705 2026] [security2:error] [pid 849:tid 849] [client 2a02:4780:12:763e::1:39722] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.tcit.org"] [uri "/wp-config.php.bak"] [unique_id "arkuM_pU6lNTDHcrUdIkxQAAACs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
BlueWire Hosting
2026-09-27 09:58:12
(2 weeks ago)
Probing websites for vulnerabilities
Web App Attack
🇳🇱
OrangeFlamingo
2026-09-27 07:01:40
(2 weeks ago)
2026-09-27 07:01:40 WARN Probe detected: uri=/api/index.php ip=[2a02:4780:12:763e::1]
...
Web App Attack
🇫🇷
✨
2026-09-23 03:22:06
(3 weeks ago)
Domain : transcendzero.co.uk
Rule : config
2026-09-23 03:20:50 2a00:5d80:7821:701::150 GET /wp-confi ...
show more
Domain : transcendzero.co.uk
Rule : config
2026-09-23 03:20:50 2a00:5d80:7821:701::150 GET /wp-config.php.old - 443 - 2a02:4780:12:763e::1 HTTP/1.1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 - www.transcendzero.co.uk 404 0 0 14649 261 779 - -
show less
Hacking
SQL Injection
🇵🇱
Budyn
2026-09-23 00:01:32
(3 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: ldap.sweetpuddingtrap.online | URI: /.git/config | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 16:57:55
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2a02:4780:12:763e::1 (srv1120525.hstgr.cloud): ...
show more
(mod_security) mod_security (id:210492) triggered by 2a02:4780:12:763e::1 (srv1120525.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:57:48.530781 2026] [security2:error] [pid 17059:tid 17341] [client 2a02:4780:12:763e::1:50270] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.leaderoftheopposition.aafm.us"] [uri "/wp-config.php.bak"] [unique_id "arKzjOHqF5Pf3Y9511nM5AAAAEU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-09-22 12:22:50
(3 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: k8s.astropot.store | URI: /.git/config | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 05:32:02
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2a02:4780:12:763e::1 (srv1120525.hstgr.cloud): ...
show more
(mod_security) mod_security (id:210492) triggered by 2a02:4780:12:763e::1 (srv1120525.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 01:31:54.846344 2026] [security2:error] [pid 11991:tid 11991] [client 2a02:4780:12:763e::1:42336] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.179vfs.com"] [uri "/.git/config"] [unique_id "arISyuyKdWi-qEFZg0QRkQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 05:03:50
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2a02:4780:12:763e::1 (srv1120525.hstgr.cloud): ...
show more
(mod_security) mod_security (id:210492) triggered by 2a02:4780:12:763e::1 (srv1120525.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 01:03:43.793612 2026] [security2:error] [pid 17308:tid 17308] [client 2a02:4780:12:763e::1:49754] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brazilianbottom.com"] [uri "/wp-config.php.save"] [unique_id "arIML_enptl_5fE96AAQFQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-09-22 03:42:53
(3 weeks ago)
High-confidence malicious configuration/VCS probe
Web App Attack
2026-09-21 15:59:30
(3 weeks ago)
path attack /index.php
Web App Attack
🇩🇪
kkw
2026-09-21 03:43:12
(3 weeks ago)
[REDACTED] 2a02:4780:12:763e::1 - - [21/Sep/2026:05:43:11 +0200] "GET /.git/config HTTP/1.1" 404 460 ...
show more
[REDACTED] 2a02:4780:12:763e::1 - - [21/Sep/2026:05:43:11 +0200] "GET /.git/config HTTP/1.1" 404 4601 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
... (mode: searching http-sensitive-files)
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 07:21:54
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2a02:4780:12:763e::1 (srv1120525.hstgr.cloud): ...
show more
(mod_security) mod_security (id:210492) triggered by 2a02:4780:12:763e::1 (srv1120525.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 03:21:50.730472 2026] [security2:error] [pid 25808:tid 25808] [client 2a02:4780:12:763e::1:43904] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "psicologos-omega.com"] [uri "/.git/config"] [unique_id "aq-Jjiq5mmygXUsZjnPWZwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-09-20 05:42:27
(3 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: forum.dont-eat-the-pudding.online | URI: /.git/config | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack