🇳🇱
homeshowdomain.nl
2026-11-12 22:59:17
UTC ·
(9 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-11.
Web App Attack
SSH
Hacking
🇺🇸
mcp-log-sentinel
2026-11-11 13:50:35
UTC ·
(1 day ago)
Log Sentinel automated defense: blocked HIGH threat (Detección de intentos de explotación SSRF o sondeo contra Next.js Server Actions vía cabecera Next-Action forjada (CVE-2024-34351).). Attack vector / Path: POST /. [Target server IP, domain names, ...
show more
Log Sentinel automated defense: blocked HIGH threat (Detección de intentos de explotación SSRF o sondeo contra Next.js Server Actions vía cabecera Next-Action forjada (CVE-2024-34351).). Attack vector / Path: POST /. [Target server IP, domain names, and internal infrastructure redacted for privacy]
show less
Hacking
Web App Attack
🇺🇸
tangisoft
2026-11-11 08:51:58
UTC ·
(2 days ago)
Next.js RSC RCE probing (CVE-2025-55182): 1 POST request to /_next/ against TangiSoft-hosted web servers, 2026-11-11T08:51:58Z to 2026-11-11T08:51:58Z UTC. All blocked (HTTP 403).
Web App Attack
Hacking
🇺🇸
dot.mg
2026-11-09 15:39:07
UTC ·
(3 days ago)
Bad behaviour
Web Spam
🇺🇸
TPI-Abuse
2026-11-09 11:12:27
UTC ·
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 125.164.232.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 06:12:19.476636 2026] [security2:error] [pid 16502:tid 16502] [client 125.164.232.221:3261 ...
show more
(mod_security) mod_security (id:225170) triggered by 125.164.232.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 06:12:19.476636 2026] [security2:error] [pid 16502:tid 16502] [client 125.164.232.221:32613] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||achildsspace.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "achildsspace.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avGqk7IvttKe49MXIeqg9QAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
jormaster3k
2026-11-09 05:01:06
UTC ·
(4 days ago)
Attack against WordPress
Web App Attack
🇺🇸
nyt
2026-11-09 04:24:42
UTC ·
(4 days ago)
Repeated WordPress login POSTs blocked by WAF (3 in 6h)
Brute-Force
Web App Attack
🇬🇧
relianoid.com
2026-11-09 04:23:03
UTC ·
(4 days ago)
404 Errors Abuse detected by Relianoid OSS Load Balancer - relianoid.com
Web App Attack
🇲🇽
octageeks.com
2026-11-08 05:20:51
UTC ·
(5 days ago)
Wordpress malicious attack:[octaflood]
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 17:39:27
UTC ·
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 125.164.232.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 12:39:10.127441 2026] [security2:error] [pid 30382:tid 30382] [client 125.164.232.221:1694 ...
show more
(mod_security) mod_security (id:225170) triggered by 125.164.232.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 12:39:10.127441 2026] [security2:error] [pid 30382:tid 30382] [client 125.164.232.221:16945] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nwuoregon.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nwuoregon.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "au9iPkX-LVZEz6bSmSsDfgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nyt
2026-11-07 16:49:39
UTC ·
(5 days ago)
Repeated WordPress login POSTs blocked by WAF (3 in 6h)
Brute-Force
Web App Attack
🇫🇷
SpaceHost-Server
2026-11-06 23:14:32
UTC ·
(6 days ago)
Brute-Force
Web App Attack
🇦🇺
screwlooseit.com.au
2026-11-06 06:09:59
UTC ·
(1 week ago)
Blocked by CSF 13 firewall - Rule: WPLOGIN
ID/Indonesia/-
Web App Attack
🇺🇸
nyt
2026-11-06 05:09:26
UTC ·
(1 week ago)
Repeated WordPress login POSTs blocked by WAF (3 in 6h)
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-11-06 04:32:14
UTC ·
(1 week ago)
125.164.232.221 - - [06/Nov/2026:05:32:12 +0100] "POST /xmlrpc.php HTTP/1.1" 403 4627 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
125.164.232.221 - - [06/Nov/2026:05:32:1 ...
show more
125.164.232.221 - - [06/Nov/2026:05:32:12 +0100] "POST /xmlrpc.php HTTP/1.1" 403 4627 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
125.164.232.221 - - [06/Nov/2026:05:32:12 +0100] "POST /xmlrpc.php HTTP/1.1" 403 4619 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
125.164.232.221 - - [06/Nov/2026:05:32:12 +0100] "POST /xmlrpc.php HTTP/1.1" 403 4623 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
125.164.232.221 - - [06/Nov/2026:05:32:12 +0100] "POST /xmlrpc.php HTTP/1.1" 403 524 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
125.164.232.221 - - [06/Nov/2026:05:32:12 +0100] "POST /xmlrpc.php HTTP/1.1" 403 524 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
125.164.232.221 - - [06/Nov/2026:05:32:12
show less
Web App Attack
Brute-Force
