🇺🇸
whatda
2026-10-08 04:18:58
(1 week ago)
HTTP tarpit triggered at /.github/workflows. Scanner trapped for ~30s. UA: python-requests/2.34.2
Bad Web Bot
Web App Attack
🇺🇸
whatda
2026-10-08 04:02:52
(1 week ago)
HTTP tarpit triggered at /.htaccess. Scanner trapped for ~30s. UA: python-requests/2.34.2
Bad Web Bot
Web App Attack
🇺🇸
whatda
2026-10-08 03:47:14
(1 week ago)
HTTP tarpit triggered at /.env.test. Scanner trapped for ~30s. UA: python-requests/2.34.2
Bad Web Bot
Web App Attack
🇨🇦
Vianpyro
2026-10-08 03:40:27
(1 week ago)
Honeypot: 5 request(s) in 716 min. Paths: /.github/workflows, /config.env, /database.ini, /phpinfo.p ...
show more
Honeypot: 5 request(s) in 716 min. Paths: /.github/workflows, /config.env, /database.ini, /phpinfo.php, /settings.js. Method(s): GET. UA: python-requests/2.34.2. ASN: 62240 (VPN Consumer Amsterdam, The Netherlands).
show less
Hacking
Bad Web Bot
Web App Attack
🇫🇷
Kejult
2026-10-08 00:13:31
(1 week ago)
Honeypot Finding: repeated TCP service probing on TCP/80 (HTTP); 3 application-level events across 3 ...
show more
Honeypot Finding: repeated TCP service probing on TCP/80 (HTTP); 3 application-level events across 3 source port(s). Sensor(s): Tanner.
show less
Port Scan
🇫🇷
Kejult
2026-10-08 00:13:31
(1 week ago)
Honeypot Finding: verified TCP multi-port scan/probing; 7 application-level events across 2 target p ...
show more
Honeypot Finding: verified TCP multi-port scan/probing; 7 application-level events across 2 target ports and 6 source port(s). Ports: 80/HTTP, 443/HTTPS. Sensors: Tanner, H0neytr4p.
show less
Port Scan
🇮🇹
VHosting
2026-09-15 14:25:04
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
2026-09-10 00:20:00
(1 month ago)
Attack detected: 45.128.199.54 [2026-09-10]
Categories: 21
--- wp2shell/batch exploit (1 hits) ---
4 ...
show more
Attack detected: 45.128.199.54 [2026-09-10]
Categories: 21
--- wp2shell/batch exploit (1 hits) ---
45.128.199.54 - - [10/Aug/2026:22:30:06 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 5194 "-" "Mozilla/5.0 (compatible; wp2shell-check/1.0)"
show less
Web App Attack
2026-08-25 23:22:04
(1 month ago)
Attack detected: 45.128.199.54 [2026-08-25]
Categories: 21
--- wp2shell/batch exploit (1 hits) ---
4 ...
show more
Attack detected: 45.128.199.54 [2026-08-25]
Categories: 21
--- wp2shell/batch exploit (1 hits) ---
45.128.199.54 - - [10/Aug/2026:22:30:06 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 5194 "-" "Mozilla/5.0 (compatible; wp2shell-check/1.0)"
show less
Web App Attack
🇺🇦
URAN Publishing Service
2026-08-20 22:38:38
(1 month ago)
[21/Aug/2026:01:38:37 +0300] -- 45.128.199.54 Ban reason: Scanner [CMS_GENERIC] | Request: GET /wp-c ...
show more
[21/Aug/2026:01:38:37 +0300] -- 45.128.199.54 Ban reason: Scanner [CMS_GENERIC] | Request: GET /wp-content/plugins/pods/readme.txt HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-08-15 13:06:48
(2 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-08-11 19:06:48
(2 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
2026-08-10 23:05:52
(2 months ago)
Attack detected: 45.128.199.54 [2026-08-10]
Categories: 21
--- wp2shell/batch exploit (1 hits) ---
4 ...
show more
Attack detected: 45.128.199.54 [2026-08-10]
Categories: 21
--- wp2shell/batch exploit (1 hits) ---
45.128.199.54 - - [10/Aug/2026:22:30:06 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 5194 "-" "Mozilla/5.0 (compatible; wp2shell-check/1.0)"
show less
Web App Attack
🇹🇷
neron
2026-08-10 14:29:21
(2 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-10 11:19:51
(2 months ago)
(mod_security) mod_security (id:210580) triggered by 45.128.199.54 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210580) triggered by 45.128.199.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 07:19:45.359682 2026] [security2:error] [pid 2926219:tid 2926219] [client 45.128.199.54:27393] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "etc/passwd" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||mlsdirect.xyz|F|2"] [data "Matched Data: etc/passwd found within ARGS:file: /etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "mlsdirect.xyz"] [uri "/wp-admin/admin-ajax.php"] [unique_id "anmz0XuLMwn0XKCnZPUungAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack