🇺🇸
NetGuard
2026-05-27 23:39:31
(1 week ago)
#honeypot #netguard247 #ciscoasa
Captured by NetGuard 24/7 T-Pot honeypot (netguard24-7.com).
Timest ...
show more
#honeypot #netguard247 #ciscoasa
Captured by NetGuard 24/7 T-Pot honeypot (netguard24-7.com).
Timestamp: 2026-05-27T23:39:31.894+00:00
Attacker IP: 31.134.6.123 | Port: N/A | Country: Seychelles
Honeypot: ciscoasa | Attack: unknown
Source: NetGuard 24/7 (netguard24-7.com) | PhantomGrid Defense
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 21:28:21
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 31.134.6.123 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 31.134.6.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 17:28:15.455309 2026] [security2:error] [pid 11494:tid 11494] [client 31.134.6.123:17351] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "epetsure.co"] [uri "/wp-config.php~"] [unique_id "ag4nb35BnSCvbFdBFEBPGQAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 15:36:16
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 31.134.6.123 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 31.134.6.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 11:36:11.606995 2026] [security2:error] [pid 3155:tid 3155] [client 31.134.6.123:61231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.bak" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ronjamestelevision.com"] [uri "/wp-config.bak"] [unique_id "ag3U6_HxI0eUrtdAkHcPtgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 13:25:53
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 31.134.6.123 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 31.134.6.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 09:25:44.696869 2026] [security2:error] [pid 8785:tid 8785] [client 31.134.6.123:25803] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.txt" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.benkatkin.passy.us"] [uri "/wp-config.txt"] [unique_id "ag22WOvqsKgi5BCdMsQHVAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 12:40:06
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 31.134.6.123 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 31.134.6.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 08:39:59.904999 2026] [security2:error] [pid 15943:tid 15943] [client 31.134.6.123:40213] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cityofhaleyville.com"] [uri "/wp-config.php.dist"] [unique_id "ag2rn8Tyw0uok1k9VlQGmQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nationaleventpros.com
2026-05-01 03:05:44
(1 month ago)
WordPress login attempt
Brute-Force
🇦🇺
MAGIC
2026-02-11 00:59:01
(3 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇩🇪
Packets-Decreaser.NET
2025-12-29 14:02:13
(5 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇫🇷
masterguru
2025-12-23 11:04:00
(5 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 31.134.6.123 (RU/Russia/-): 1 in the last 3600 ...
show more
(modsec_5015) ModSec 5015: Suspicious User-Agent from 31.134.6.123 (RU/Russia/-): 1 in the last 3600 secs (0-197)
show less
Hacking
🇺🇸
fbarela
2025-11-23 02:00:17
(6 months ago)
FortiGate SSL VPN login failures.
Hacking
Brute-Force
🇳🇱
exxos
2025-10-30 20:03:01
(7 months ago)
HTTP1.x attacks
DDoS Attack
🇳🇱
exxos
2025-10-30 16:03:01
(7 months ago)
HTTP1.x attacks
DDoS Attack