2024-06-20 05:22:09
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_MODSEC
Brute-Force
SSH
2024-06-20 02:00:47
(1 year ago)
Ports: *; Direction: 0; Trigger: CT_LIMIT
Brute-Force
SSH
🇧🇪
cmbplf
2024-06-19 09:22:00
(2 years ago)
244 requests to *.php.bak
136 requests to *wp-config.php
Brute-Force
Bad Web Bot
🇨🇭
🇨🇭 Hosting
2024-06-14 05:44:09
(2 years ago)
Used in participation of a (D)DoS attack
DDoS Attack
🇪🇸
10dencehispahard SL
2024-06-08 16:00:04
(2 years ago)
Unauthorized login attempts [ dovecot, wordpress-xmlrpc]
Brute-Force
Web App Attack
🇵🇱
rafix
2024-01-24 16:05:07
(2 years ago)
DDoS, #botnet240124
DDoS Attack
Bad Web Bot
🇩🇪
akasolutions.de
2024-01-17 02:33:54
(2 years ago)
(mod_security) mod_security triggered on hostname [redacted] 87.249.132.98 (DE/Germany/unn-87-249-13 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 87.249.132.98 (DE/Germany/unn-87-249-132-98.datapacket.com)
show less
SQL Injection
🇫🇷
uhlhosting
2024-01-16 21:35:13
(2 years ago)
idleslidegloves.com 87.249.132.98 - - [16/Jan/2024:22:34:45.227935 +0100] "GET /.wp-config.gz HTTP/1 ...
show more
idleslidegloves.com 87.249.132.98 - - [16/Jan/2024:22:34:45.227935 +0100] "GET /.wp-config.gz HTTP/1.1" 403 199 "-" "-" Zab2daxuFDpFcCs5COKY9gAAAAw "-" /apache/20240116/20240116-2234/20240116-223445-Zab2daxuFDpFcCs5COKY9gAAAAw 0 1207 md5:f1388a14accc6ea667116049c3a3ea17
idleslidegloves.com 87.249.132.98 - - [16/Jan/2024:22:34:54.850051 +0100] "GET /.wp-config.php.old HTTP/1.1" 403 199 "-" "-" Zab2fn0bLSxGlNfQqHWK8wAAAII "-" /apache/20240116/20240116-2234/20240116-223454-Zab2fn0bLSxGlNfQqHWK8wAAAII 0 1217 md5:0d06d61b06edb9b1d17e146a8d15c416
idleslidegloves.com 87.249.132.98 - - [16/Jan/2024:22:34:55.760852 +0100] "GET /.wp-config.php.swp HTTP/1.1" 403 199 "-" "-" Zab2f30bLSxGlNfQqHWK9wAAAIU "-" /apache/20240116/20240116-2234/20240116-223455-Zab2f30bLSxGlNfQqHWK9wAAAIU 0 1217 md5:12f71bd0207c5340df9bb5538f418de6
idleslidegloves.com 87.249.132.98 - - [16/Jan/2024:22:35:10.668486 +0100] "GET /.wp-config.bak HTTP/1.1" 403 199 "-" "-" Zab2jn0bLSxGlNfQqHWLJwAAAJE "-" /apache/20240116/2024
...
show less
DDoS Attack
Brute-Force
🇺🇸
TPI-Abuse
2024-01-16 19:15:26
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 87.249.132.98 (unn-87-249-132-98.datapacket.com ...
show more
(mod_security) mod_security (id:210492) triggered by 87.249.132.98 (unn-87-249-132-98.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 16 14:15:17.633379 2024] [security2:error] [pid 7896] [client 87.249.132.98:62317] [client 87.249.132.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.ideaofauniversity.website"] [uri "/wp-content/themes/the-wp/down.php"] [unique_id "ZabVxb5mkBtoZTkIkN70EAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-01-16 17:17:05
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 87.249.132.98 (unn-87-249-132-98.datapacket.com ...
show more
(mod_security) mod_security (id:210492) triggered by 87.249.132.98 (unn-87-249-132-98.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 16 12:16:58.220000 2024] [security2:error] [pid 15066] [client 87.249.132.98:54287] [client 87.249.132.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.idahostem.org"] [uri "/wp-content/themes/hello-elementor/down.php"] [unique_id "Zaa6CgrX7M1K4ryya1dlSAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-01-16 17:02:40
(2 years ago)
suspicious behavior
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2024-01-16 14:41:46
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 87.249.132.98 (unn-87-249-132-98.datapacket.com ...
show more
(mod_security) mod_security (id:210492) triggered by 87.249.132.98 (unn-87-249-132-98.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 16 09:41:40.017036 2024] [security2:error] [pid 13606] [client 87.249.132.98:45965] [client 87.249.132.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "iconbizpromo.com"] [uri "/wp-content/themes/u-design/down.php"] [unique_id "ZaaVpC3mzok2Q7WMnzdZYgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2023-10-23 05:09:18
(2 years ago)
Too many Status 40X (16)
Brute-Force
Web App Attack
🇱🇹
EIC
2023-10-23 00:11:00
(2 years ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 87.249.132.98 (DE/German ...
show more
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 87.249.132.98 (DE/Germany/unn-87-249-132-98.datapacket.com): (CF_ENABLE)
show less
Port Scan
🇱🇹
EIC
2023-10-21 21:30:53
(2 years ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 87.249.132.98 (DE/German ...
show more
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 87.249.132.98 (DE/Germany/unn-87-249-132-98.datapacket.com): (CF_ENABLE)
show less
Port Scan