🇹🇷
rtbh.com.tr
2025-11-27 20:10:10
UTC ·
(11 months ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇺🇸
myagent.site
2025-11-27 03:10:42
UTC ·
(11 months ago)
Blocking for trying to access an exploit file: /xmlrpc.php
Hacking
🇺🇦
URAN Publishing Service
2025-11-27 01:26:17
UTC ·
(11 months ago)
52.254.82.180 - - [27/Nov/2025:03:24:18 +0200] "GET /cgi-bin/ HTTP/1.1" 404 439 "https://www.google.de/" "Mozilla/5.g (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36"
52.254.82.180 - - [27/Nov ...
show more
52.254.82.180 - - [27/Nov/2025:03:24:18 +0200] "GET /cgi-bin/ HTTP/1.1" 404 439 "https://www.google.de/" "Mozilla/5.g (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36"
52.254.82.180 - - [27/Nov/2025:03:26:17 +0200] "GET /wp-admin/ HTTP/1.1" 404 196 "https://www.google.co.uk/" "Mozilla/5.0 (iPad; CPU OS 17_0_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0.1 Mobile/15E148 Safari/604.1"
...
show less
Web App Attack
2025-11-27 01:20:20
UTC ·
(11 months ago)
[Thu Nov 27 02:20:19.909914 2025] [authz_core:error] [pid 30140] [client 52.254.82.180:14383] AH01630: client denied by server configuration: /etc/httpd/htdocs, referer: https://duckduckgo.com/
[Thu Nov 27 02:20:20.020984 2025] [authz_core:error] [pi ...
show more
[Thu Nov 27 02:20:19.909914 2025] [authz_core:error] [pid 30140] [client 52.254.82.180:14383] AH01630: client denied by server configuration: /etc/httpd/htdocs, referer: https://duckduckgo.com/
[Thu Nov 27 02:20:20.020984 2025] [authz_core:error] [pid 30140] [client 52.254.82.180:14383] AH01630: client denied by server configuration: /etc/httpd/htdocs, referer: https://www.google.com/
[Thu Nov 27 02:20:20.116341 2025] [authz_core:error] [pid 30140] [client 52.254.82.180:14383] AH01630: client denied by server configuration: /etc/httpd/htdocs, referer: https://www.google.fr/
...
show less
Web App Attack
🇫🇷
SpaceHost-Server
2025-11-26 23:41:45
UTC ·
(11 months ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 20:23:50
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 52.254.82.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:23:40.913262 2025] [security2:error] [pid 12138:tid 12138] [client 52.254.82.180:0] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 52.254.82.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:23:40.913262 2025] [security2:error] [pid 12138:tid 12138] [client 52.254.82.180:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.ralphrichardson.com"] [uri "/user/.env"] [unique_id "aSdhzHoGptlTAGBIyokFXQAAACs"], referer: https://www.bing.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
rtbh.com.tr
2025-11-26 20:10:07
UTC ·
(11 months ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇺🇸
snappic
2025-11-26 20:01:25
UTC ·
(11 months ago)
Malicious URI path [GET /updates.php] [Mozilla/5.0 (Linux; Android 13; SM-S908E) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36]
Bad Web Bot
Web App Attack
🇺🇸
Major Hostility
2025-11-26 16:41:25
UTC ·
(11 months ago)
"GET /cgi-bin/ HTTP/1.1" 404
"GET /cgi-bin/bypass.php HTTP/1.1" 404
"GET /filemanager/dialog.php HTTP/1.1" 404
"GET /wp-admin/css/ HTTP/1.1" 404
"GET /xmlrpc.php HTTP/1.1" 403
"GET /index1.php HTTP/1.1" 404
"GET /wp-content/ HTTP/1.1" 404
"GET /radio ...
show more
"GET /cgi-bin/ HTTP/1.1" 404
"GET /cgi-bin/bypass.php HTTP/1.1" 404
"GET /filemanager/dialog.php HTTP/1.1" 404
"GET /wp-admin/css/ HTTP/1.1" 404
"GET /xmlrpc.php HTTP/1.1" 403
"GET /index1.php HTTP/1.1" 404
"GET /wp-content/ HTTP/1.1" 404
"GET /radio.php HTTP/1.1" 404
"GET /1index.php HTTP/1.1" 404
"GET /wp-admin/admin-ajax.php HTTP/1.1" 404
"GET /aa.php HTTP/1.1" 404
"GET /api.php HTTP/1.1" 404
"GET /cgi-bin/xmrlpc.php HTTP/1.1" 404
"GET /i.php HTTP/1.1" 404
"GET /info.php HTTP/1.1" 404
"GET /php.php HTTP/1.1" 404
"GET /phpinfo HTTP/1.1" 404
"GET /phpinfo.php HTTP/1.1" 404
"GET /pi.php HTTP/1.1" 404
"GET /index4.php HTTP/1.1" 404
"GET /fonts/datab
show less
Web App Attack
🇳🇱
Roderic
2025-11-26 15:38:12
UTC ·
(11 months ago)
(wordpress-404) Searching for non-existent wordpress installs from 52.254.82.180 (US/United States/Virginia/Boydton/-/[redacted])
Brute-Force
🇺🇸
WizardsToolkit
2025-11-26 14:25:34
UTC ·
(11 months ago)
attempted to access
Web App Attack
🇩🇪
Mr-Money
2025-11-26 12:13:14
UTC ·
(11 months ago)
scenario: crowdsecurity/http-probing - events: 11
Hacking
Web App Attack
🇺🇸
Rip
2025-11-26 12:06:46
UTC ·
(11 months ago)
Attacks against MySQL, MariaDB, and/or phpMyAdmin.
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 11:31:55
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 52.254.82.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 06:31:51.947769 2025] [security2:error] [pid 7468:tid 7468] [client 52.254.82.180:1525] ModS ...
show more
(mod_security) mod_security (id:210492) triggered by 52.254.82.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 06:31:51.947769 2025] [security2:error] [pid 7468:tid 7468] [client 52.254.82.180:1525] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.engelhardtkraatz.com"] [uri "/user/.env"] [unique_id "aSblJ5dLLHtTiv1beBC_5AAAAAw"], referer: https://www.yahoo.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2025-11-26 10:03:17
UTC ·
(11 months ago)
Excessive multi-domain requests
Brute-Force