🇺🇸
TPI-Abuse
2026-06-15 20:05:37
(5 hours ago)
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.am ...
show more
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 16:05:33.058728 2026] [security2:error] [pid 16628:tid 16628] [client 100.31.124.106:36384] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.fundingangelinvestors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.fundingangelinvestors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajBbDfPG22ER64PXfW3dQAAAAC8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
ycoskun41
2026-06-15 11:10:26
(14 hours ago)
fail2ban: plesk-modsecurity jail on genckocaeli.com
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 09:08:30
(16 hours ago)
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.am ...
show more
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 05:08:25.995202 2026] [security2:error] [pid 22299:tid 22309] [client 100.31.124.106:51904] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.koalacogs.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.koalacogs.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai_BCVnMxNHZ3S5tZJdh3gAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-06-15 02:15:19
(23 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 00:08:59
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.am ...
show more
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 20:08:52.959967 2026] [security2:error] [pid 17984:tid 17996] [client 100.31.124.106:53124] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.pwihatah.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.pwihatah.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai9ClLnK6wgMFOJSNS9OKwAAAUk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 11:35:29
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.am ...
show more
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 07:35:21.259650 2026] [security2:error] [pid 15517:tid 15517] [client 100.31.124.106:41900] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.bikinitweets.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.bikinitweets.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai6R-eUUfz5LM8qW0kbkqAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 01:13:00
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.am ...
show more
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 21:12:57.040232 2026] [security2:error] [pid 28413:tid 28413] [client 100.31.124.106:49912] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.pharmaceuticalsalescertifications.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.pharmaceuticalsalescertifications.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai4AGf3IpyO6IUKuiQcsugAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 20:38:58
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.am ...
show more
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 16:38:54.126945 2026] [security2:error] [pid 16524:tid 16541] [client 100.31.124.106:40022] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.amazinglips.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.amazinglips.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai2_3pz8eaM-IvXAiqD9mgAAAQ4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-13 19:45:06
(2 days ago)
[redacted] 100.31.124.106 - - [13/Jun/2026:21:45:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" " ...
show more
[redacted] 100.31.124.106 - - [13/Jun/2026:21:45:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:40.0) Gecko/20100101 Firefox/40.0"
[redacted] 100.31.124.106 - - [13/Jun/2026:21:45:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0"
[redacted] 100.31.124.106 - - [13/Jun/2026:21:45:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0"
[redacted] 100.31.124.106 - - [13/Jun/2026:21:45:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:46.0) Gecko/20100101 Firefox/46.0"
[redacted] 100.31.124.106 - - [13/Jun/2026:21:45:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:44.0) Gecko/20100101 Firefox/44.0"
apoll
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 17:50:23
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.am ...
show more
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 13:50:16.285781 2026] [security2:error] [pid 15331:tid 15331] [client 100.31.124.106:45226] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.convtek.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.convtek.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai2YWEyoxthWVnVoHYo6bAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-13 04:55:04
(2 days ago)
Bot / scanning and/or hacking attempts: GET /author/gdadmin/ HTTP/1.1, GET /?author=1 HTTP/1.1, POST ...
show more
Bot / scanning and/or hacking attempts: GET /author/gdadmin/ HTTP/1.1, GET /?author=1 HTTP/1.1, POST /xmlrpc.php HTTP/1.1, GET /wp-json/wp/v2/users HTTP/1.1, GET /?author=3 HTTP/1.1, GET / HTTP/1.1, GET /author/admin/ HTTP/1.1
show less
Hacking
Web App Attack
2026-06-13 04:18:20
(2 days ago)
[redacted] 100.31.124.106 - - [13/Jun/2026:06:18:15 +0200] "POST /xmlrpc.php HTTP/1.1" 200 262 "-" " ...
show more
[redacted] 100.31.124.106 - - [13/Jun/2026:06:18:15 +0200] "POST /xmlrpc.php HTTP/1.1" 200 262 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0"
[redacted] 100.31.124.106 - - [13/Jun/2026:06:18:15 +0200] "POST /xmlrpc.php HTTP/1.1" 200 262 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0"
[redacted] 100.31.124.106 - - [13/Jun/2026:06:18:16 +0200] "POST /xmlrpc.php HTTP/1.1" 200 262 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0"
[redacted] 100.31.124.106 - - [13/Jun/2026:06:18:17 +0200] "POST /xmlrpc.php HTTP/1.1" 200 262 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0"
[redacted] 100.31.124.106 - - [13/Jun/2026:06:18:17 +0200] "POST /xmlrpc.php HTTP/1.1" 200 262 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:40.0) Gecko/20100101 Firefox/40.0"
[redacted] 100.31.124.106 - - [13/Jun/2026:06:18:17 +0200] "POST /xmlrpc.php HTTP/1.1" 20
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 03:44:05
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.am ...
show more
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 23:43:59.358792 2026] [security2:error] [pid 16739:tid 16739] [client 100.31.124.106:35874] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||savingspools.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "savingspools.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aizR_43uUzX3FvQrFJKe-wAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 02:30:37
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.am ...
show more
(mod_security) mod_security (id:225170) triggered by 100.31.124.106 (ec2-100-31-124-106.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 22:30:33.801872 2026] [security2:error] [pid 32488:tid 32488] [client 100.31.124.106:47756] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.blaslandsporthorses.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.blaslandsporthorses.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aizAyQLgQjnotMThgPeXOQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-12 03:52:12
(3 days ago)
100.31.124.106 - - [12/Jun/2026:05:52:11 +0200] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Mozilla/5.0 ...
show more
100.31.124.106 - - [12/Jun/2026:05:52:11 +0200] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0"
100.31.124.106 - - [12/Jun/2026:05:52:10 +0200] "POST /xmlrpc.php HTTP/1.1" 200 420 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0"
100.31.124.106 - - [12/Jun/2026:05:52:11 +0200] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0"
100.31.124.106 - - [12/Jun/2026:05:52:10 +0200] "POST /xmlrpc.php HTTP/1.1" 200 420 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0"
100.31.124.106 - - [12/Jun/2026:05:52:11 +0200] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0) Gecko/20100101 Firefox/87.0"
...
show less
Brute-Force
Web App Attack