🇨🇦
zXero
2026-06-18 21:06:33
(3 days ago)
Fail2Ban automatic report - jail: no-wordpress
Brute-Force
SSH
DDoS Attack
🇺🇸
mnsf
2026-06-15 01:06:58
(1 week ago)
Xmlrpc Caught (7)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 13:14:54
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 126.209.74.189 (czqhcuyo.189.reserved.infinivan ...
show more
(mod_security) mod_security (id:225170) triggered by 126.209.74.189 (czqhcuyo.189.reserved.infinivan.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 09:14:48.942066 2026] [security2:error] [pid 24620:tid 24620] [client 126.209.74.189:64382] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ruthbalser.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ruthbalser.org"] [uri "/wp-json/wp/v2/users"] [unique_id "ai6pSC0C_zf3JsA1Z3uA7QAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-14 12:50:03
(1 week ago)
Bot / scanning and/or hacking attempts: GET /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇫🇮
inlink.ltd
2026-06-14 11:40:16
(1 week ago)
Known malicious PHP file or CMS probe
Web App Attack
🇳🇱
Site.eu
2026-06-14 06:18:42
(1 week ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-06-14 02:09:49
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 126.209.74.189 (czqhcuyo.189.reserved.infinivan ...
show more
(mod_security) mod_security (id:225170) triggered by 126.209.74.189 (czqhcuyo.189.reserved.infinivan.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 22:09:44.592386 2026] [security2:error] [pid 10839:tid 10839] [client 126.209.74.189:56366] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fundingangelinvestors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fundingangelinvestors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai4NaCRptY2CMYuA7BG8CQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇽
octageeks.com
2026-06-13 04:20:31
(1 week ago)
Wordpress malicious attack:[octaxmlrpc]
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 00:26:11
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 126.209.74.189 (czqhcuyo.189.reserved.infinivan ...
show more
(mod_security) mod_security (id:225170) triggered by 126.209.74.189 (czqhcuyo.189.reserved.infinivan.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 20:26:07.374446 2026] [security2:error] [pid 31062:tid 31062] [client 126.209.74.189:61703] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||elgatocapa.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "elgatocapa.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiyjn0rvNIa5uYJ1B34GbAAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-06-12 12:02:53
(1 week ago)
[FriJun1214:02:51.9392462026][security2:error][pid3660135:tid3660266][client126.209.74.189:0]ModSecu ...
show more
[FriJun1214:02:51.9392462026][security2:error][pid3660135:tid3660266][client126.209.74.189:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"prstartup.ch\"][uri\"/xmlrpc.php\"][unique_id\"aiv1a6DJvt5QOrgqZFjD5AAAARQ\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
wlt-blocker
2026-06-11 11:18:07
(1 week ago)
Unauthorized access to webpage admin
Web App Attack
🇩🇪
ghostwarriors
2026-06-11 01:20:27
(1 week ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-06-10 13:51:15
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
🇨🇦
zXero
2026-06-10 12:37:27
(1 week ago)
Fail2Ban automatic report - jail: no-wordpress
Brute-Force
SSH
DDoS Attack
🇺🇸
TPI-Abuse
2026-06-09 13:15:57
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 126.209.74.189 (czqhcuyo.189.reserved.infinivan ...
show more
(mod_security) mod_security (id:225170) triggered by 126.209.74.189 (czqhcuyo.189.reserved.infinivan.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 09:15:51.765413 2026] [security2:error] [pid 14525:tid 14525] [client 126.209.74.189:49795] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||globalweb123.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "globalweb123.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aigSB4T-dv_N_CKGJpIJhgAAADI"]
show less
Brute-Force
Bad Web Bot
Web App Attack