🇹🇷
neron
2026-10-17 08:00:07
(1 week ago)
CrowdSec blocked: http:dos detected via OPNsense firewall
Hacking
Web App Attack
🇩🇪
Viveronese
2026-10-14 02:43:43
(2 weeks ago)
Wordpress vulnerability scanning
Web App Attack
🇳🇱
Site.eu
2026-10-14 02:02:40
(2 weeks ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
Ben Schoolland
2026-10-13 22:19:28
(2 weeks ago)
WordPress credential brute-force against chalkwild.com: 3 failed POST /wp-login.php (HTTP 200, login form re-rendered) between 13/Oct/2026:05:11:27 and 13/Oct/2026:06:36:46 UTC, plus 2 GET /wp-admin/ probes that returned 302 to the login page. User-A ...
show more
WordPress credential brute-force against chalkwild.com: 3 failed POST /wp-login.php (HTTP 200, login form re-rendered) between 13/Oct/2026:05:11:27 and 13/Oct/2026:06:36:46 UTC, plus 2 GET /wp-admin/ probes that returned 302 to the login page. User-Agent rotated across 7 distinct strings from this single address. Part of a coordinated campaign from 49 addresses in 45.131.195.0/24 (240 failed logins today), each pacing itself under per-IP rate thresholds. No successful authentication.
show less
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-10-13 22:04:44
(2 weeks ago)
WordPress wp-login.php Brute Force Attack
Brute-Force
Web App Attack
🇨🇦
KIsmay
2026-10-13 18:47:05
(2 weeks ago)
2026-10-13T14:45:54.305690-04:00 www4 WPAudit[2246490]: 45.131.195.124 www.terencegower.com "Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:118.0) Gecko/20100101 Firefox/118.0" terenceg:qwertyuiop FAIL
2026-10-13T14:46:33.121921-04:00 www4 WPAudit[2246 ...
show more
2026-10-13T14:45:54.305690-04:00 www4 WPAudit[2246490]: 45.131.195.124 www.terencegower.com "Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:118.0) Gecko/20100101 Firefox/118.0" terenceg:qwertyuiop FAIL
2026-10-13T14:46:33.121921-04:00 www4 WPAudit[2246490]: 45.131.195.124 www.terencegower.com "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" tonyg:qwertyuiop FAIL
2026-10-13T14:46:42.114372-04:00 www4 WPAudit[2246490]: 45.131.195.124 www.terencegower.com "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" admin:asdfgh123 FAIL
2026-10-13T14:46:52.759425-04:00 www4 WPAudit[2246490]: 45.131.195.124 www.terencegower.com "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1; rv:119.0) Gecko/20100101 Firefox/119.0" administrator:asdfgh123 FAIL
2026-10-13T14:47:04.449241-04:00 www4 WPAudit[2246490]: 45.131.195.124 www.terencegower.com "Mozilla/5.0 (Macintosh; Intel Mac OS X
...
show less
Brute-Force
Web App Attack
🇦🇺
screwlooseit.com.au
2026-10-13 08:32:48
(2 weeks ago)
Blocked by CSF 13 firewall - Rule: WPLOGIN
NL/Netherlands/-
Web App Attack
2026-10-12 23:31:45
(2 weeks ago)
Banned by Fail2Ban on server
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 01:40:19
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 45.131.195.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 21:40:15.450995 2026] [security2:error] [pid 5602:tid 5602] [client 45.131.195.124:36027] M ...
show more
(mod_security) mod_security (id:225170) triggered by 45.131.195.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 21:40:15.450995 2026] [security2:error] [pid 5602:tid 5602] [client 45.131.195.124:36027] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ruthbalser.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ruthbalser.org"] [uri "/wp-json/wp/v2/users"] [unique_id "asw6f3oIsLLxFL2xWtsFPAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
masterguru
2026-10-11 02:44:17
(2 weeks ago)
(wplogin) Failed WordPress login from 45.131.195.124 (US/United States/-): 5 in the last 3600 secs (0-122)
Hacking
🇺🇸
Jason Howell
2026-10-10 21:47:38
(2 weeks ago)
45.131.195.124 - - [10/Oct/2026:16:46:11 -0500] "GET /wp-admin/edit.php HTTP/1.1" 302 4509 "https://www.ponderosamobilehomepark.com/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:120.0) Gecko/20100101 Firefox/120.0"
45.131.195.124 ...
show more
45.131.195.124 - - [10/Oct/2026:16:46:11 -0500] "GET /wp-admin/edit.php HTTP/1.1" 302 4509 "https://www.ponderosamobilehomepark.com/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:120.0) Gecko/20100101 Firefox/120.0"
45.131.195.124 - - [10/Oct/2026:16:46:13 -0500] "GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.ponderosamobilehomepark.com%2Fwp-admin%2Fedit.php&reauth=1 HTTP/1.1" 200 3736 "https://www.ponderosamobilehomepark.com/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:120.0) Gecko/20100101 Firefox/120.0"
45.131.195.124 - - [10/Oct/2026:16:46:13 -0500] "POST /wp-login.php HTTP/1.1" 200 2099 "https://www.ponderosamobilehomepark.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
45.131.195.124 - - [10/Oct/2026:16:47:33 -0500] "POST /wp-login.php HTTP/1.1" 200 6111 "https://www.ponderosamobilehomepark.com/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1;
...
show less
Web App Attack
🇺🇸
Jason Howell
2026-10-10 16:04:03
(2 weeks ago)
45.131.195.124 - - [10/Oct/2026:10:28:02 -0500] "POST /wp-login.php HTTP/1.1" 200 6321 "https://www.barbsgardenandpantry.com/wp-login.php" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.3 ...
show more
45.131.195.124 - - [10/Oct/2026:10:28:02 -0500] "POST /wp-login.php HTTP/1.1" 200 6321 "https://www.barbsgardenandpantry.com/wp-login.php" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
45.131.195.124 - - [10/Oct/2026:10:28:03 -0500] "GET /wp-admin/index.php HTTP/1.1" 302 468 "https://www.barbsgardenandpantry.com/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15"
45.131.195.124 - - [10/Oct/2026:10:28:08 -0500] "GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.barbsgardenandpantry.com%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 4116 "https://www.barbsgardenandpantry.com/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15"
45.131.195.124 - - [10/Oct/2026:10:40:44 -0500] "GET /wp-admin/edit.php HTTP/1.1" 302 4470 "https://www.barbsgardenandpantry.com/wp-login.p
...
show less
Web App Attack
🇺🇸
jormaster3k
2026-10-10 14:38:33
(2 weeks ago)
Attack against WordPress
Web App Attack
🇨🇦
KIsmay
2026-10-10 04:49:47
(2 weeks ago)
2026-10-09T21:46:36.951304-07:00 ismay WPAudit[4186495]: 45.131.195.124 christinesutherland.com "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:119.0) Gecko/20100101 Firefox/119.0" thomas:thomas@123 FAIL
2026-10-09T21:49:09.229841-07:00 ismay WPA ...
show more
2026-10-09T21:46:36.951304-07:00 ismay WPAudit[4186495]: 45.131.195.124 christinesutherland.com "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:119.0) Gecko/20100101 Firefox/119.0" thomas:thomas@123 FAIL
2026-10-09T21:49:09.229841-07:00 ismay WPAudit[4186487]: 45.131.195.124 christinesutherland.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" thomas:thomas000 FAIL
2026-10-09T21:49:20.167924-07:00 ismay WPAudit[4186486]: 45.131.195.124 christinesutherland.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0" wyatt:wyatt FAIL
2026-10-09T21:49:35.213214-07:00 ismay WPAudit[4186486]: 45.131.195.124 christinesutherland.com "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1; rv:120.0) Gecko/20100101 Firefox/120.0" wyatt:password FAIL
2026-10-09T21:49:46.836716-07:00 ismay WPAudit[4186486]: 45.131.195.124 christinesutherland.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K
...
show less
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-10-04 06:07:49
(3 weeks ago)
[ti-tinov] WordPress login brute-force: 5 suspicious requests detected by fail2ban jail <name>. Example: 45.131.195.124 - - \[04/Oct/2026:08:04:54 +0200\] "POST /wp-login.php HTTP/1.1" 200 2203 "https://pipportal.eu/wp-login.php" "Mozilla/5.0 \(X11\; ...
show more
[ti-tinov] WordPress login brute-force: 5 suspicious requests detected by fail2ban jail <name>. Example: 45.131.195.124 - - \[04/Oct/2026:08:04:54 +0200\] "POST /wp-login.php HTTP/1.1" 200 2203 "https://pipportal.eu/wp-login.php" "Mozilla/5.0 \(X11\; Linux x86_64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/120.0.0.0 Safari/537.36"
45.131.195.124 - - \[04/Oct/2026:08:04:57 +0200\] "POST /wp-login.php HTTP/1.1" 200 2203 "https://pipportal.eu/wp-login.php" "Mozilla/5.0 \(Windows NT 11.0\; Win64\; x64\; rv:118.0\) Gecko/20100101 Firefox/118.0"
45.131.195.124 - - \[04/Oct/2026:08:05:01 +0200\] "POST /wp-login.php HTTP/1.1" 200 2203 "https://pipportal.eu/wp-login.php" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/605.1.15 \(KHTML, like Gecko\) Version/16.6 Safari/605.1.15"
45.131.195.124 - - \[04/Oct/2026:08
...
show less
Brute-Force
Web App Attack
