2026-11-12 04:33:54
UTC ·
(2 days ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇿🇦
conure.sh
2026-11-09 12:14:58
UTC ·
(5 days ago)
csagent: score 19.9: wp-config backup grab x2; 1 domain(s) in 2s
Web App Attack
🇧🇪
cmbplf
2026-11-08 20:37:40
UTC ·
(5 days ago)
277 requests with url.path *.php.bak
Brute-Force
Bad Web Bot
2026-11-08 18:41:06
UTC ·
(5 days ago)
Bot / scanning and/or hacking attempts: [0/0] init, GET /wp-config.php.old HTTP/2.0, [1/1] done, GET /wp-config.php.bak HTTP/2.0, GET /wp-config.php.backup HTTP/2.0, GET /wp-config.php.bak HTTP/1.1, GET /wp-config.php.old HTTP/1.1, GET /wp-config.php ...
show more
Bot / scanning and/or hacking attempts: [0/0] init, GET /wp-config.php.old HTTP/2.0, [1/1] done, GET /wp-config.php.bak HTTP/2.0, GET /wp-config.php.backup HTTP/2.0, GET /wp-config.php.bak HTTP/1.1, GET /wp-config.php.old HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET /wp-config.php~ HTTP/2.0
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 18:34:16
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 45.154.229.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:34:09.056837 2026] [security2:error] [pid 24793:tid 24793] [client 45.154.229.219:60058] ...
show more
(mod_security) mod_security (id:210492) triggered by 45.154.229.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:34:09.056837 2026] [security2:error] [pid 24793:tid 24793] [client 45.154.229.219:60058] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "newcitypark.com"] [uri "/wp-config.php.backup"] [unique_id "avDAoWSff5n2osXzdDsaTgAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-11-08 18:30:11
UTC ·
(5 days ago)
csagent: score 20.2: wp-config backup grab x2, 404 noise floor x1; 1 domain(s) in 1s
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 18:06:15
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 45.154.229.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:06:11.798823 2026] [security2:error] [pid 13655:tid 13655] [client 45.154.229.219:57428] ...
show more
(mod_security) mod_security (id:210492) triggered by 45.154.229.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:06:11.798823 2026] [security2:error] [pid 13655:tid 13655] [client 45.154.229.219:57428] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nordicbuilders.net"] [uri "/wp-config.php.backup"] [unique_id "avC6E-BdlnAs6ZgGZjKgDgAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
paissangroup
2026-11-08 17:47:50
UTC ·
(5 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 17:32:48
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 45.154.229.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 12:32:42.855493 2026] [security2:error] [pid 28209:tid 28209] [client 45.154.229.219:51277] ...
show more
(mod_security) mod_security (id:210492) triggered by 45.154.229.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 12:32:42.855493 2026] [security2:error] [pid 28209:tid 28209] [client 45.154.229.219:51277] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nypatriotcards.com"] [uri "/wp-config.php.backup"] [unique_id "avCyOoioY3OK6neAr7VnAgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-08 16:54:27
UTC ·
(5 days ago)
[ti-01sc] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 45.154.229.219 - - [08/Nov/2026:17:54:17 +0100] "GET /wp-config.php.backup HTTP/1.1" 301 475 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple ...
show more
[ti-01sc] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 45.154.229.219 - - [08/Nov/2026:17:54:17 +0100] "GET /wp-config.php.backup HTTP/1.1" 301 475 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 16:29:31
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 45.154.229.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 11:29:23.935203 2026] [security2:error] [pid 22670:tid 22670] [client 45.154.229.219:35925] ...
show more
(mod_security) mod_security (id:210492) triggered by 45.154.229.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 11:29:23.935203 2026] [security2:error] [pid 22670:tid 22670] [client 45.154.229.219:35925] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "newcastle91.org"] [uri "/wp-config.php.backup"] [unique_id "avCjY76eJRvsRxcNn4-njwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-08 16:23:51
UTC ·
(5 days ago)
(wp_config_access) srv101 WordPress wp-config probe 45.154.229.219 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇹🇷
Jova
2026-11-08 16:07:14
UTC ·
(5 days ago)
Probing a web server for sensitive files (.env, backups, configs): 3 requests.
Web App Attack
🇧🇷
Halux
2026-11-08 15:06:17
UTC ·
(5 days ago)
45.154.229.219 Web Application Firewall multiple violations
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 14:48:38
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 45.154.229.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 09:48:32.337457 2026] [security2:error] [pid 23192:tid 23192] [client 45.154.229.219:47183] ...
show more
(mod_security) mod_security (id:210492) triggered by 45.154.229.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 09:48:32.337457 2026] [security2:error] [pid 23192:tid 23192] [client 45.154.229.219:47183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oakglenhouse.com"] [uri "/wp-config.php.backup"] [unique_id "avCLwFv1Zld-lguwuD9sfQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
