🇨🇿
vitex
2026-05-26 04:00:00
(4 weeks ago)
Automated distributed scraping of Forgejo git server (git.vitexsoftware.com). Bots systematically cr ...
show more
Automated distributed scraping of Forgejo git server (git.vitexsoftware.com). Bots systematically crawled git blame endpoints (/*/blame/commit/<hash>/file) across all commits of public repositories, causing server load of 17+ (normal: <2). Over 71,000 unique IPs involved. Attack window: 2026-05-26 03:30-06:37 UTC. Primary target: PureHTML/purezencart (9933 commits, 5065 files). Each blame request triggers expensive git operations; 30,000+ slow requests per hour.
show less
DDoS Attack
Bad Web Bot
🇹🇷
rtbh.com.tr
2026-02-05 20:11:24
(4 months ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇮🇹
VHosting
2025-12-24 00:40:13
(6 months ago)
Detected attack and reported by a human
DDoS Attack
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
2025-12-10 15:24:38
(6 months ago)
botnet
DDoS Attack
🇺🇸
TPI-Abuse
2025-11-28 05:52:33
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 28 00:52:28.930320 2025] [security2:error] [pid 22122:tid 22122] [client 102.129.235.216:56924] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rohn.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rohn.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSk4nOR44cW0YDaTor79uwAAAAM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-28 02:50:55
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 21:50:52.244037 2025] [security2:error] [pid 10892:tid 10892] [client 102.129.235.216:32489] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cmgpartners.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cmgpartners.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSkODBXeOqG2920y8Mey-QAAAAo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-27 21:11:25
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 16:11:22.232419 2025] [security2:error] [pid 30125:tid 30125] [client 102.129.235.216:31326] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||shiner.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "shiner.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aSi-epBc81fz_0RredGedAAAACI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-27 19:41:44
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 14:41:40.749381 2025] [security2:error] [pid 25782:tid 25782] [client 102.129.235.216:21334] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||versallis.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "versallis.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSipdNIi_Pz2-3y31MhFkwAAABQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
voormedia
2025-11-27 19:19:15
(6 months ago)
Accessed trap at '/xmlrpc.php'
Web App Attack
🇺🇸
TPI-Abuse
2025-11-27 19:03:09
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 14:03:02.384138 2025] [security2:error] [pid 3939:tid 3939] [client 102.129.235.216:9358] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fales-lorenz.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fales-lorenz.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aSigZl6_UuuJCXcEPM0ZtgAAACM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-27 18:25:29
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 13:25:24.687028 2025] [security2:error] [pid 27792:tid 27792] [client 102.129.235.216:47267] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||castagnino.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "castagnino.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSiXlMdpDLaXEGCR6p2WVgAAAAw"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2025-11-27 16:25:03
(6 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2025-11-27 15:55:43
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 102.129.235.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 10:55:38.909361 2025] [security2:error] [pid 32070:tid 32070] [client 102.129.235.216:51254] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fastpc.biz|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fastpc.biz"] [uri "/wp-json/wp/v2/users"] [unique_id "aSh0eocDNkL6zgjQ7J7cdAAAABA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
oncord
2025-04-30 09:51:35
(1 year ago)
Form spam
Web Spam
🇨🇭
trading1617.internet-box.ch
2025-04-23 07:32:44
(1 year ago)
Brute-Force