🇩🇪
FeG Deutschland
2026-10-26 12:22:43
(15 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 11:12:27
(16 hours ago)
(mod_security) mod_security (id:225170) triggered by 103.36.19.106 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 103.36.19.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 07:12:13.785177 2026] [security2:error] [pid 24303:tid 24303] [client 103.36.19.106:57354] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jennyfiore.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jennyfiore.com"] [uri "/wp-json/wp/v2/users"] [unique_id "at81jT8u-moUO0lsbo_w1wAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇹
Malta
2026-10-24 17:44:52
(2 days ago)
103.36.19.106 - - [24/Oct/2026:19:44:51 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows N ...
show more
103.36.19.106 - - [24/Oct/2026:19:44:51 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
Brute-force password attempt
show less
Hacking
Web App Attack
Brute-Force
🇩🇪
LRob
2026-10-23 03:34:51
(4 days ago)
Proxynvader botnet: code forge crawl | path: /WP/email-toolkit/src/commit/84780637c8b8cef1ef02397887 ...
show more
Proxynvader botnet: code forge crawl | path: /WP/email-toolkit/src/commit/84780637c8b8cef1ef02397887749f290a3d1c83/lrob-email-toolkit.php | src_port: 38410 | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | 2026-10-23 03:34 UTC
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-22 12:07:40
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 103.36.19.106 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 103.36.19.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 08:07:26.561833 2026] [security2:error] [pid 11611:tid 11611] [client 103.36.19.106:45970] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bonnesfrequences.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bonnesfrequences.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atn8fsuFe8GMNZOTDKlXAQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-20 05:07:59
(6 days ago)
Web application attack detected.
Web App Attack
2026-10-18 09:47:25
(1 week ago)
Attempt to POST to xmlrpc.php at 2026-10-18T09:47:25+00:00
Brute-Force
Web App Attack
🇩🇪
Packets-Decreaser.NET
2026-10-12 15:33:52
(2 weeks ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
etu brutus
2026-10-11 01:15:46
(2 weeks ago)
103.36.19.106 has been banned for [WebApp Pipeline]
...
Hacking
Bad Web Bot
Web App Attack
🇺🇸
Mundo Bueno
2026-10-10 00:35:31
(2 weeks ago)
[ISILIA Protection v2.3] Tentative d'accès: /wp-json/wp/v2/users/me [RATE LIMITED - 1800s quarantine ...
show more
[ISILIA Protection v2.3] Tentative d'accès: /wp-json/wp/v2/users/me [RATE LIMITED - 1800s quarantine] | Pays: PH | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Sa
show less
Hacking
Web App Attack
🇫🇷
Sklurk
2026-10-09 06:22:33
(2 weeks ago)
Web App Attack
Web App Attack
🇺🇸
SX Communications
2026-10-06 13:56:50
(2 weeks ago)
Web spam bot from 103.36.19.106: automated HTTPS requests for fake pharmacy / prescription / drug SE ...
show more
Web spam bot from 103.36.19.106: automated HTTPS requests for fake pharmacy / prescription / drug SEO URLs (bbs and blog product-style paths). 4 hits; paths: /blogs/slammingpeas/Online-Pharmacy-Skin-Treatments">Online.
show less
Web Spam
Blog Spam
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-06 10:47:32
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 103.36.19.106 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 103.36.19.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 06:47:07.985859 2026] [security2:error] [pid 26918:tid 26918] [client 103.36.19.106:42610] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||syscoxlegends.com.darkcodedesign.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "syscoxlegends.com.darkcodedesign.net"] [uri "/old/production.sql"] [unique_id "asTRq_7ZhMV1cEgfUJpdIAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-10-06 04:58:49
(2 weeks ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=60&topics%5B4%5D=53&topics%5B5%5D=31&topics%5B6%5D=62 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15")
show less
DDoS Attack
Bad Web Bot
🇨🇿
Countryman
2026-10-01 00:10:02
(3 weeks ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force