🇮🇹
CoreTech srl
2026-09-14 08:58:56
(2 hours ago)
cloudlinux2 fail2ban: 2026-09-14 10:54:14,795 fail2ban.filter [1908]: INFO [plesk-wordpre ...
show more
cloudlinux2 fail2ban: 2026-09-14 10:54:14,795 fail2ban.filter [1908]: INFO [plesk-wordpress] Found 124.246.91.194 - 2026-09-14 10:54:14cloudlinux2 fail2ban: 2026-09-14 10:54:53,195 fail2ban.filter [1908]: INFO [plesk-wordpress] Found 82.35.172.14 - 2026-09-14 10:54:52cloudlinux2 fail2ban: 2026-09-14 10:55:39,079 fail2ban.filter [1908]: INFO [plesk-modsecurity] Found 107.21.136.0 - 2026-09-14 10:55:39cloudlinux2 fail2ban: 2026-09-14 10:55:38,965 fail2ban.filter [1908]: INFO [plesk-modsecurity] Found 107.21.136.0 - 2026-09-14 10:55:38cloudlinux2 fail2ban: 2026-09-14 10:55:39,186 fail2ban.filter [1908]: INFO [plesk-modsecurity] Found 107.21.136.0 - 2026-09-14 10:55:39cloudlinux2 fail2ban: 2026-09-14 10:55:39,054 fail2ban.filter [1908]: INFO [plesk-modsecurity] Found 107.21.136.0 - 2026-09-14 10:55:39cloudlinux2 fail2ban: 2026-09-14 10:55:39,066 fail2ban.filter [1908]: INFO [plesk-modsecurity] Found 107.21.136.0 - 2026-09-14 10:55:39clou
show less
Web App Attack
🇺🇸
nationaleventpros.com
2026-09-14 05:53:21
(5 hours ago)
WordPress login attempt
Brute-Force
🇩🇪
FeG Deutschland
2026-09-14 04:01:42
(7 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 19:49:27
(15 hours ago)
(mod_security) mod_security (id:225170) triggered by 124.246.91.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 124.246.91.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 15:49:22.326485 2026] [security2:error] [pid 29985:tid 29985] [client 124.246.91.194:53322] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||walkingwithafricans.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "walkingwithafricans.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aqb-QsQDKnvdGUzWdaO4EwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Apache
2026-09-11 18:05:16
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 124.246.91.194 (SG/Singapore/-): 5 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 124.246.91.194 (SG/Singapore/-): 5 in the last 300 secs
show less
Brute-Force
Web App Attack
🇩🇪
FeG Deutschland
2026-09-11 16:40:13
(2 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-09-10 14:59:57
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 124.246.91.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 124.246.91.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 10 10:59:49.174106 2026] [security2:error] [pid 19021:tid 19021] [client 124.246.91.194:57316] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||harvestfrc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "harvestfrc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqLF5aJ68ku5b4ldVbTOOAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-09-10 13:39:44
(3 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-09-09 06:11:19
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 124.246.91.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 124.246.91.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 09 02:11:13.539177 2026] [security2:error] [pid 15762:tid 15762] [client 124.246.91.194:45358] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||celebritybikinigossip.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "celebritybikinigossip.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aqD4geePgSkv8KQLkRMALwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-09-09 04:17:15
(5 days ago)
WordPress Brute Force
Brute-Force
🇩🇪
FeG Deutschland
2026-09-09 00:21:43
(5 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇩🇪
LRob
2026-09-08 23:08:31
(5 days ago)
Enumerating paths that do not exist (scanning) | method: GET | path: /wp-json/wp/v2/users/me | 2026- ...
show more
Enumerating paths that do not exist (scanning) | method: GET | path: /wp-json/wp/v2/users/me | 2026-09-08 23:08 UTC
show less
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 22:19:11
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 124.246.91.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 124.246.91.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 18:19:03.052810 2026] [security2:error] [pid 3198:tid 3198] [client 124.246.91.194:39346] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lysedzija.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lysedzija.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aqCJ18oDcmTI1AG22zFfZwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 15:58:08
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 124.246.91.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 124.246.91.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 11:58:02.959205 2026] [security2:error] [pid 1155:tid 1155] [client 124.246.91.194:46854] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||terfgunclub.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "terfgunclub.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aqAwil5u0bhqyVCf78G0zAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-09-08 08:51:47
(6 days ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.
Bad Web Bot
Web App Attack