🇺🇸
cwytech
2026-10-17 10:30:35
(2 hours ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/tpot-http-wordpress-scan.
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-10-17 10:26:59
(2 hours ago)
[SatOct1712:26:55.3306462026][security2:error][pid1561808:tid1561876][client45.156.87.150:0]ModSecur ...
show more
[SatOct1712:26:55.3306462026][security2:error][pid1561808:tid1561876][client45.156.87.150:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\^/wp-content/plugins/[\^/] /\(readme\\\\\\\\.txt\|changelog\\\\\\\\.txt\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"735\"][id\"960828\"][msg\"WordPresspluginenumerationblocked\"][hostname\"hostingedominio.ch\"][uri\"/wp-content/plugins/gdpr-cookie-consent/readme.txt\"][unique_id\"atNNb0WnUb8w5qn8Zcb25AAAAQA\"]
show less
Hacking
Web App Attack
🇺🇸
ssssssssssssssssssssuper
2026-10-17 05:17:29
(7 hours ago)
45.156.87.150 - - [17/Oct/2026:01:16:22 -0400] "GET /wp-content/plugins/gdpr-cookie-consent/readme.t ...
show more
45.156.87.150 - - [17/Oct/2026:01:16:22 -0400] "GET /wp-content/plugins/gdpr-cookie-consent/readme.txt HTTP/1.1" 404 15169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"
45.156.87.150 - - [17/Oct/2026:01:17:27 -0400] "GET /wp-content/plugins/user-registration/readme.txt HTTP/1.1" 404 15169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15"
45.156.87.150 - - [17/Oct/2026:01:17:28 -0400] "GET /wp-content/plugins/user-registration-pro/readme.txt HTTP/1.1" 404 15169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"
...
show less
Port Scan
Hacking
Bad Web Bot
Web App Attack
🇵🇱
strefapi_com
2026-10-17 03:11:11
(9 hours ago)
Brute-force, web
...
Hacking
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-10-16 23:30:20
(13 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: budyn.wtf | URI: /wp-content/plugins/user-registration/readme.txt | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15 | BODY: [Empty / GET Request]
show less
Hacking
Web App Attack
🇮🇹
CoreTech srl
2026-10-16 23:26:19
(13 hours ago)
[DC: IP:151.1.252.27] ntopng alert: blacklisted_client_contact
Hacking
🇫🇷
Lunix
2026-10-16 21:50:15
(14 hours ago)
Brute-Force
Web App Attack
🇩🇪
ghostwarriors
2026-10-15 18:50:25
(1 day ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
n2nguyenn2nguyen
2026-10-15 15:07:10
(1 day ago)
Blocked by YFC Security on https://parcl9.com — type: directory_scan_attempts
Web App Attack
🇩🇪
msavo
2026-10-15 09:03:07
(2 days ago)
CIR Sentinel: env_probe_permanent; 1 requests in 60s; targets=/.env; permanently blocked by the fire ...
show more
CIR Sentinel: env_probe_permanent; 1 requests in 60s; targets=/.env; permanently blocked by the firewall.
show less
Web App Attack
🇩🇪
ger-stg-sifi1
2026-10-15 08:31:12
(2 days ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
gadix
2026-10-15 08:20:35
(2 days ago)
[15/Oct/2026:10:20:33.788305 +0200] atCM0fR26B2zXAZXSzWhowAAAAk 45.156.87.150 56890 127.0.0.1 7081
[ ...
show more
[15/Oct/2026:10:20:33.788305 +0200] atCM0fR26B2zXAZXSzWhowAAAAk 45.156.87.150 56890 127.0.0.1 7081
[15/Oct/2026:10:20:33.819210 +0200] atCM0fuITTe70ORZ9DGpiQAAAAQ 45.156.87.150 56904 127.0.0.1 7081
[15/Oct/2026:10:20:33.849769 +0200] atCM0S6IMLkCX4jH3qyU-QAAAAE 45.156.87.150 56918 127.0.0.1 7081
...
show less
Web App Attack
🇺🇸
Rayulcifer
2026-10-15 05:08:11
(2 days ago)
45.156.87.150 - - [15/Oct/2026:00:08:10 -0500] "GET /.env HTTP/2.0" 403 269 "-" "Mozilla/5.0 (X11; L ...
show more
45.156.87.150 - - [15/Oct/2026:00:08:10 -0500] "GET /.env HTTP/2.0" 403 269 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0"
...
show less
Open Proxy
Port Scan
Hacking
Web App Attack
SSH
🇩🇪
FeG Deutschland
2026-10-15 05:00:53
(2 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇳🇱
tmiland
2026-10-15 03:52:55
(2 days ago)
(nginx_404) Dot directory Honeypot Trap 45.156.87.150 (-): 2 in the last 3600 secs; IP: 45.156.87.15 ...
show more
(nginx_404) Dot directory Honeypot Trap 45.156.87.150 (-): 2 in the last 3600 secs; IP: 45.156.87.150; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 45.156.87.150 - - [15/Oct/2026:05:52:52 +0200] "GET /.env HTTP/1.1" 404 12058 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" 45.156.87.150 - - [15/Oct/2026:05:52:52 +0200] "GET /.git/config HTTP/1.1" 404 12058 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
show less
Brute-Force