2026-06-13 08:43:11
(5 days ago)
[redacted] 108.61.216.168 - - [13/Jun/2026:10:43:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" " ...
show more
[redacted] 108.61.216.168 - - [13/Jun/2026:10:43:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0"
[redacted] 108.61.216.168 - - [13/Jun/2026:10:43:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0"
[redacted] 108.61.216.168 - - [13/Jun/2026:10:43:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0"
[redacted] 108.61.216.168 - - [13/Jun/2026:10:43:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0"
[redacted] 108.61.216.168 - - [13/Jun/2026:10:43:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0"
[redacted] 108.61.216.168 -
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 06:37:32
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 02:37:24.907018 2026] [security2:error] [pid 25364:tid 25364] [client 108.61.216.168:38544] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.yogawithbubba.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.yogawithbubba.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiz6pA-1JfMDeSRZ-09AgQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 00:42:12
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 20:42:08.445361 2026] [security2:error] [pid 22314:tid 22314] [client 108.61.216.168:41064] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.lajoze.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.lajoze.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiynYD6DuQ4SW-Xf7fZdewAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇨
icp77
2026-06-12 16:25:00
(6 days ago)
Abuse DDoS
DDoS Attack
Port Scan
Brute-Force
Exploited Host
Web App Attack
SSH
FTP Brute-Force
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-06-12 15:17:09
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 11:17:04.268271 2026] [security2:error] [pid 8119:tid 8119] [client 108.61.216.168:41522] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.tonydelov.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.tonydelov.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiwi8CBbL8XFb6XKfZBt7QAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-06-12 14:07:48
(6 days ago)
Probing websites for vulnerabilities
Web App Attack
SQL Injection
🇹🇷
ycoskun41
2026-06-12 10:07:36
(6 days ago)
fail2ban: plesk-modsecurity jail on genckocaeli.com
Web App Attack
🇳🇱
Site.eu
2026-06-12 09:50:55
(6 days ago)
Excessive 404/403 errors
Brute-Force
2026-06-12 05:19:01
(6 days ago)
[redacted] 108.61.216.168 - - [12/Jun/2026:07:18:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" " ...
show more
[redacted] 108.61.216.168 - - [12/Jun/2026:07:18:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0"
[redacted] 108.61.216.168 - - [12/Jun/2026:07:18:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0"
[redacted] 108.61.216.168 - - [12/Jun/2026:07:18:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0"
[redacted] 108.61.216.168 - - [12/Jun/2026:07:18:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0"
[redacted] 108.61.216.168 - - [12/Jun/2026:07:18:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0"
[redacted] 108.61.216.168 - -
...
show less
Hacking
Web App Attack
🇲🇽
octageeks.com
2026-06-12 04:19:09
(6 days ago)
Wordpress malicious attack:[octawpauthor]
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 01:11:33
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 21:11:29.975595 2026] [security2:error] [pid 17985:tid 17985] [client 108.61.216.168:46920] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.allotrope.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.allotrope.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aitcwY5PdcKQVmQVT9-kYAAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 18:10:33
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 14:10:27.759258 2026] [security2:error] [pid 20064:tid 20064] [client 108.61.216.168:59564] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.kerrywood.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.kerrywood.com"] [uri "/wp-json/wp/v2/users"] [unique_id "air6Ex6HmCfjeHPgs8LcSQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 11:40:32
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 07:40:28.424788 2026] [security2:error] [pid 10311:tid 10430] [client 108.61.216.168:48604] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gabegabel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gabegabel.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiqerGFzva38OS08eYyPegAAAQM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
masterguru
2026-06-11 01:47:27
(1 week ago)
xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (5000900-122)
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 01:47:13
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 108.61.216.168 (108.61.216.168.vultrusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 21:47:10.191863 2026] [security2:error] [pid 31005:tid 31005] [client 108.61.216.168:53072] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.investorsfundingusa.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.investorsfundingusa.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aioTntjYJbXQZ0uV06l5uQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack