🇺🇸
TAY
2026-09-12 19:20:51
(2 hours ago)
45.231.83.2 - - [13/Sep/2026:03:11:25 +0800] "GET /wp-config.php.save HTTP/1.1" 404 53592 "-" "Mozil ...
show more
45.231.83.2 - - [13/Sep/2026:03:11:25 +0800] "GET /wp-config.php.save HTTP/1.1" 404 53592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
45.231.83.2 - - [13/Sep/2026:03:11:56 +0800] "GET /wp-config.php.orig HTTP/1.1" 404 53592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
45.231.83.2 - - [13/Sep/2026:03:12:28 +0800] "GET /wp-config.php.swp HTTP/1.1" 404 53570 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
45.231.83.2 - - [13/Sep/2026:03:19:59 +0800] "GET /wp-config.php.bak HTTP/1.1" 404 53592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
45.231.83.2 - - [13/Sep/2026:03:20:05 +0800] "GET /wp-config.php~ HTTP/1.1" 404 53570 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-09-12 17:54:19
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 45.231.83.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.231.83.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 13:54:16.309673 2026] [security2:error] [pid 10054:tid 10054] [client 45.231.83.2:47432] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "j3pr.com"] [uri "/wp-config.php.save"] [unique_id "aqWRyJZRbtaY_T71Sz2P2wAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 17:19:13
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 45.231.83.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.231.83.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 13:19:09.308803 2026] [security2:error] [pid 3988495:tid 3988495] [client 45.231.83.2:49034] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.joevallone.com"] [uri "/wp-config.php.save"] [unique_id "aqWJjdijURulm4f6coDkwwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 16:58:48
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 45.231.83.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.231.83.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 12:58:44.726864 2026] [security2:error] [pid 4073091:tid 4073103] [client 45.231.83.2:52730] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "almerirock.com"] [uri "/wp-config.php.save"] [unique_id "aqWExMgLAeCPFz2doX4b0gAAAIo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
taivas.nl
2026-09-12 16:32:02
(5 hours ago)
Wordpress_attack_2
Web App Attack
🇫🇷
masterguru
2026-09-12 16:18:57
(5 hours ago)
Attempt to access a backup or working file. Pattern match "\\\\. (920500-195)
Hacking
🇳🇱
BlueWire Hosting
2026-09-12 14:53:12
(6 hours ago)
Aggressive scanning resulting into 404
Bad Web Bot
🇲🇾
Rizzy
2026-09-12 13:41:02
(8 hours ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇨🇦
polycoda
2026-09-12 12:46:49
(9 hours ago)
AutoBlock: 📡 Port Scan (Non Decay-Based)
Port Scan
🇨🇦
Anytech
2026-09-12 12:24:24
(9 hours ago)
Blocked by Conn-Monitor: env-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-12 12:21:08
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 45.231.83.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.231.83.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 08:21:01.964330 2026] [security2:error] [pid 30728:tid 30739] [client 45.231.83.2:32832] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ccgparquitectos.com"] [uri "/wp-config.php.old"] [unique_id "aqVDrZMOi1n34-2_lqY1WQAAAUk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 11:46:19
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 45.231.83.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.231.83.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 07:46:12.951566 2026] [security2:error] [pid 9543:tid 9584] [client 45.231.83.2:51142] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.conservativedemocrat.aafm.us"] [uri "/wp-config.php.orig"] [unique_id "aqU7hFTiJRjWBne8J4Of_gAAAYI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-09-12 10:40:51
(11 hours ago)
csagent: score 20.4: 404 noise floor x2, wp-config backup grab x2; 1 domain(s) in 2s
Web App Attack
🇧🇪
cmbplf
2026-09-12 10:28:47
(11 hours ago)
133 requests with url.path *.php.bak
118 requests with url.path */debug.log
118 requests with url ...
show more
133 requests with url.path *.php.bak
118 requests with url.path */debug.log
118 requests with url.path *debug.log
show less
Brute-Force
Bad Web Bot
🇮🇹
VHosting
2026-09-12 09:35:03
(12 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack