🇺🇸
TPI-Abuse
2026-06-19 23:33:26
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 19:33:20.068905 2026] [security2:error] [pid 22129:tid 22129] [client 112.213.89.115:55676] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||airtechconsulting.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "airtechconsulting.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "ajXRwKHjLa0v_LcuofEkKQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-19 22:17:50
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 18:17:46.126547 2026] [security2:error] [pid 15658:tid 15658] [client 112.213.89.115:60778] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||michelehoop.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "michelehoop.com"] [uri "/wp-json/wp/v2/users/5"] [unique_id "ajXAClKT_mMj7ZBAgWNu3wAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-19 20:55:07
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 16:55:01.302356 2026] [security2:error] [pid 9945:tid 10038] [client 112.213.89.115:40406] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||blackhillschristmas.omegaoak.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "blackhillschristmas.omegaoak.com"] [uri "/wp-json/wp/v2/users/8"] [unique_id "ajWspRRKtWLiO274ZfsRLwAAAQg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-19 18:38:42
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 14:38:38.495433 2026] [security2:error] [pid 3459:tid 3474] [client 112.213.89.115:50816] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nimbll.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nimbll.com"] [uri "/wp-json/wp/v2/users/10"] [unique_id "ajWMrpC7Lp0Epf-zPIilTAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xxkodedxx
2026-06-19 18:13:51
(1 day ago)
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get in 10m window.
...
show more
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get in 10m window.
Active: 18:13:44 UTC
Volume: 1 honeypot probe(s)
Bait taken: /wp-json/ultimate-member/v1/users?per_page=100&_fields=user_login,display_name
UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
🇲🇽
octageeks.com
2026-06-19 04:08:26
(1 day ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇨🇭
Peter-Johann Sarbach
2026-06-19 02:30:14
(2 days ago)
Hacking website
Hacking
🇺🇸
TPI-Abuse
2026-06-18 17:09:15
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 13:09:09.558700 2026] [security2:error] [pid 23662:tid 23662] [client 112.213.89.115:41652] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hayresearch.am|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hayresearch.am"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ajQmNcOkaOkO6ZBASTZ17AAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Ba-Yu
2026-06-18 11:23:25
(2 days ago)
WordPress bruteforce
Web Spam
Hacking
Brute-Force
Exploited Host
Web App Attack
🇲🇽
octageeks.com
2026-06-18 04:07:20
(2 days ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇩🇪
Hazzard
2026-06-17 21:30:40
(3 days ago)
(wordpress) Failed wordpress login from 112.213.89.115 (VN/Vietnam/-/-/babyshark.maychu.cloud/[redac ...
show more
(wordpress) Failed wordpress login from 112.213.89.115 (VN/Vietnam/-/-/babyshark.maychu.cloud/[redacted]): (CF_ENABLE)
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-06-16 12:45:37
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 08:45:33.730634 2026] [security2:error] [pid 11518:tid 11518] [client 112.213.89.115:56380] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||sacoriverjazz.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sacoriverjazz.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ajFFbWrGdeVZoeEXvhlvmwAAACk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-16 00:41:28
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 20:41:20.239429 2026] [security2:error] [pid 3799:tid 3799] [client 112.213.89.115:57542] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||copanmaya.org.asociacioncopan.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "copanmaya.org.asociacioncopan.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ajCbsOWLpoBzpeEx1UxB-QAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 03:50:52
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 112.213.89.115 (babyshark.maychu.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 23:50:45.706516 2026] [security2:error] [pid 4935:tid 4935] [client 112.213.89.115:34116] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||us.abecasis.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "us.abecasis.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ai4lFQ_e9_TzaFtGE7j4HwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
tecnicorioja
2026-06-13 22:00:43
(1 week ago)
wp-login attack [13/Jun/2026:20:23:01
Brute-Force
Web App Attack