🇩🇪
Vegascosmetics
2026-06-15 07:02:23
(2 days ago)
(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security
DDoS Attack
Hacking
Exploited Host
🇺🇸
drewf.ink
2026-05-12 16:31:06
(1 month ago)
[16:31] Attempted telnet login on port 23 with username root
Brute-Force
Exploited Host
🇫🇷
security.rdmc.fr
2026-05-08 13:45:09
(1 month ago)
Port Scan Attack proto:TCP src:20930 dst:23
Port Scan
2026-02-27 11:53:28
(3 months ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-25 16:25:31
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 103.244.49.33 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 103.244.49.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 25 11:25:26.930357 2026] [security2:error] [pid 20067:tid 20067] [client 103.244.49.33:58058] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||d365geek.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "d365geek.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZ8idmJPluLhifI9osGYqwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-19 19:26:13
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 103.244.49.33 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 103.244.49.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 19 14:26:05.957512 2026] [security2:error] [pid 14682:tid 14714] [client 103.244.49.33:62066] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||chelseyrae.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "chelseyrae.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZdjzUasjsUxdxrow47O9gAAANU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-02-13 14:42:23
(4 months ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
gui-ying233
2026-02-04 04:25:08
(4 months ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Sa ...
show more
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2025-12-09 08:29:08
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 103.244.49.33 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 103.244.49.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 09 03:29:04.443681 2025] [security2:error] [pid 29823:tid 29823] [client 103.244.49.33:53863] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||phoboschildren.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "phoboschildren.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aTfd0OpVc0UqN-ogjrxqQAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-19 01:31:19
(6 months ago)
scanning http requests from known botnet
Web App Attack
🇺🇸
TPI-Abuse
2025-10-15 08:35:37
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 103.244.49.33 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 103.244.49.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 15 04:35:33.977454 2025] [security2:error] [pid 10743:tid 10743] [client 103.244.49.33:54288] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||incrp.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "incrp.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aO9c1ZhEfA8kkU73_WWGTAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
✨
2025-10-12 17:45:02
(8 months ago)
Domain : misubasta.net
Rule : xmlrpc
2025-10-12 17:43:35 152.53.151.170 POST /xmlrpc.php - 443 - 162 ...
show more
Domain : misubasta.net
Rule : xmlrpc
2025-10-12 17:43:35 152.53.151.170 POST /xmlrpc.php - 443 - 162.158.163.154 HTTP/2 Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/64.0.0.0 Safari/537.36 - misubasta.net 404 0 0 10308 1163 278 - 103.244.49.33
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-10-12 17:16:16
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 103.244.49.33 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 103.244.49.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 12 13:16:10.335657 2025] [security2:error] [pid 6378:tid 6378] [client 103.244.49.33:56610] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||magnoliahillproductions.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "magnoliahillproductions.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aOviWlVRgBnB9F2T9me1CwAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
cleverest.eu
2025-10-10 09:37:21
(8 months ago)
MimirWAF has 1 incident from 1 distinct domain => {"bad_request_uri / script_kiddie_detection"}
Web App Attack
🇩🇪
LRob.fr
2025-09-14 19:32:12
(9 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack