🇫🇮
paissangroup
2026-08-26 06:25:43
(12 hours ago)
Multiple WAF Violations
Web App Attack
🇩🇪
HandyTreff.de
2026-07-13 08:33:47
(1 month ago)
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -40.688 (Bad < -10 / Very Bad < -20 ...
show more
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -40.688 (Bad < -10 / Very Bad < -20 / Extreme < -35) | UA: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:106.0) Gecko/20100101 Firefox/106.0
show less
Web App Attack
Bad Web Bot
🇺🇸
www.winos.me
2026-04-03 10:34:50
(4 months ago)
Banned due to high error rate on HTTP/1.1 protocol
Brute-Force
Web App Attack
🇩🇪
kjaerulff
2026-03-11 13:38:10
(5 months ago)
Failed Wordpress login using wp-login.php
Web App Attack
🇩🇪
Packets-Decreaser.NET
2025-12-29 14:01:24
(7 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇩🇪
HandyTreff.de
2025-11-20 15:17:18
(9 months ago)
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -21.734 (Bad < -10 / Very Bad < -20) ...
show more
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -21.734 (Bad < -10 / Very Bad < -20) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Sa
show less
Bad Web Bot
Web App Attack
🇺🇸
ph
2025-10-26 04:50:23
(10 months ago)
Bad web bot attempting to run wp-login.php on non-WP site
Hacking
Bad Web Bot
Web App Attack
🇺🇸
xmission.com
2025-10-25 13:37:14
(10 months ago)
130.49.10.204 - - [25/Oct/2025:07:37:13 -0600] "POST /wp-login.php HTTP/1.1" 200 2315 "https://dooce ...
show more
130.49.10.204 - - [25/Oct/2025:07:37:13 -0600] "POST /wp-login.php HTTP/1.1" 200 2315 "https://dooce.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203"
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2025-10-25 10:47:52
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 130.49.10.204 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 130.49.10.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 25 06:47:47.959759 2025] [security2:error] [pid 26448:tid 26448] [client 130.49.10.204:58791] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||manaplas.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "manaplas.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aPyq0wetA_XS2IhRXlCa-QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-24 22:05:07
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 130.49.10.204 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 130.49.10.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 24 18:05:00.931495 2025] [security2:error] [pid 10612:tid 10612] [client 130.49.10.204:31143] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||marinestorage.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "marinestorage.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aPv4DOLbdEe74JAVMI4HDwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-24 15:13:25
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 130.49.10.204 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 130.49.10.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 24 11:13:20.718351 2025] [security2:error] [pid 21636:tid 21647] [client 130.49.10.204:54065] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||woofnrose.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "woofnrose.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aPuXkGZspwFoJ5Fa_QAuHAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
MM-bot
2025-10-23 03:25:57
(10 months ago)
URL-probe: HTTP/1.1 GET request on /wp-login.php (2025-10-23 05:25:57 UTC+2)
Hacking
Web App Attack
2025-10-23 00:15:10
(10 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-10-22 20:16:36
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 130.49.10.204 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 130.49.10.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 22 16:16:30.835840 2025] [security2:error] [pid 15584:tid 15584] [client 130.49.10.204:61579] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cmcnow.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cmcnow.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aPk7nogzw_SkG7pySvGOAwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ne1for23
2025-10-22 11:17:57
(10 months ago)
130.49.10.204 - - [22/Oct/2025:11:17:52 +0000] "GET /wp-login.php HTTP/1.1" 403 555 "-" "Mozilla/5.0 ...
show more
130.49.10.204 - - [22/Oct/2025:11:17:52 +0000] "GET /wp-login.php HTTP/1.1" 403 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203"
show less
Web App Attack