🇺🇸
mnsf
2025-12-09 03:05:02
(6 months ago)
Too many Status 40X (12)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-12-08 22:37:50
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 109.203.124.63 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 109.203.124.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 08 17:37:43.168645 2025] [security2:error] [pid 19700:tid 19700] [client 109.203.124.63:62908] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||dw-consultancy.nl|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dw-consultancy.nl"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aTdTNxR0G_plgIo_12hX2wAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2025-12-08 19:10:36
(6 months ago)
(modsec_5040) ModSec 5040: API Basic Auth blocked from 109.203.124.63 (GB/United Kingdom/-): 1 in th ...
show more
(modsec_5040) ModSec 5040: API Basic Auth blocked from 109.203.124.63 (GB/United Kingdom/-): 1 in the last 3600 secs (0-196)
show less
Hacking
🇺🇸
octageeks.com
2025-08-04 04:09:05
(10 months ago)
Wordpress malicious attack:[octaxmlrpc]
Web App Attack
🇩🇪
stinpriza
2025-08-03 20:44:09
(10 months ago)
Web App Attack
Web App Attack
🇩🇪
Ba-Yu
2025-08-03 19:41:37
(10 months ago)
WP-xmlrpc exploit
Web Spam
Blog Spam
Hacking
Exploited Host
Web App Attack
2025-08-03 18:35:59
(10 months ago)
(wordpress) Failed wordpress login from 109.203.124.63 (GB/United Kingdom/-)
Brute-Force
🇩🇪
FeG Deutschland
2025-08-03 18:34:14
(10 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2025-07-30 23:10:22
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 109.203.124.63 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 109.203.124.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 30 19:10:16.001618 2025] [security2:error] [pid 2774:tid 2774] [client 109.203.124.63:59509] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ryszardwycisk.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ryszardwycisk.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aIqmVxS6Oo3rHuNe03azGQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-30 19:57:05
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 109.203.124.63 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 109.203.124.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 30 15:56:57.627251 2025] [security2:error] [pid 18478:tid 18478] [client 109.203.124.63:51147] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||timetemple.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "timetemple.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aIp5CQdp9VSSklqvK-yBVAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-30 19:22:19
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 109.203.124.63 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 109.203.124.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 30 15:22:11.343698 2025] [security2:error] [pid 32619:tid 32619] [client 109.203.124.63:63501] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cmcnow.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cmcnow.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aIpw4_NPoZ1mm5410IL5uQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
gu-alvareza
2025-07-24 07:05:14
(10 months ago)
WordPress.REST.API.Username.Enumeration.Information.Disclosure
Web App Attack
🇩🇪
LRob.fr
2025-07-23 00:45:13
(10 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇫🇮
bittiguru.fi
2025-07-22 23:53:35
(10 months ago)
109.203.124.63 - [23/Jul/2025:02:53:33 +0300] "POST /xmlrpc.php HTTP/1.1" 404 19492 "-" "Mozilla/5.0 ...
show more
109.203.124.63 - [23/Jul/2025:02:53:33 +0300] "POST /xmlrpc.php HTTP/1.1" 404 19492 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36" "-"
109.203.124.63 - [23/Jul/2025:02:53:34 +0300] "POST /wordpress/xmlrpc.php HTTP/1.1" 403 1770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36" "-"
...
show less
Hacking
Brute-Force
Web App Attack
🇺🇸
mawan
2025-07-22 23:27:58
(10 months ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack