2026-11-12 02:56:05
UTC ·
(10 hours ago)
POST /xmlrpc.php HTTP/1.1
...
Brute-Force
🇺🇸
TPI-Abuse
2026-11-12 01:03:53
UTC ·
(12 hours ago)
(mod_security) mod_security (id:225170) triggered by 131.221.48.238 (131-221-48-238.sempre.tec.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 20:03:47.340533 2026] [security2:error] [pid 9286:tid 9286] [cli ...
show more
(mod_security) mod_security (id:225170) triggered by 131.221.48.238 (131-221-48-238.sempre.tec.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 20:03:47.340533 2026] [security2:error] [pid 9286:tid 9286] [client 131.221.48.238:5911] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||aimer.es|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aimer.es"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avUQcxmMtPEu8kQLoRDVgAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-11-11 12:14:28
UTC ·
(1 day ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 02:34:46
UTC ·
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 131.221.48.238 (131-221-48-238.sempre.tec.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 21:34:41.919086 2026] [security2:error] [pid 24447:tid 24447] [c ...
show more
(mod_security) mod_security (id:225170) triggered by 131.221.48.238 (131-221-48-238.sempre.tec.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 21:34:41.919086 2026] [security2:error] [pid 24447:tid 24447] [client 131.221.48.238:5882] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||northfortworthalliance.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "northfortworthalliance.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avPUQZREFQ_rYqHQW4OaqwAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-10 21:50:43
UTC ·
(1 day ago)
2026-11-10T22:50:42.652694+01:00 aion wordpress[732099]: Blocked user enumeration attempt from 131.221.48.238
...
Hacking
Brute-Force
🇵🇱
Budyn
2026-11-10 04:10:14
UTC ·
(2 days ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_12 | Action: AWS API Call | Token ID: akf9s74n5eldbzbpzbzf5lt45 | Client tool: silentvs-hitworker/1
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 22:22:48
UTC ·
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 131.221.48.238 (131-221-48-238.sempre.tec.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 17:22:40.594057 2026] [security2:error] [pid 23010:tid 23010] [c ...
show more
(mod_security) mod_security (id:225170) triggered by 131.221.48.238 (131-221-48-238.sempre.tec.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 17:22:40.594057 2026] [security2:error] [pid 23010:tid 23010] [client 131.221.48.238:5899] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||austintrauma.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "austintrauma.com"] [uri "/wp/wp-json/wp/v2/users"] [unique_id "au5TMNRgmZl1LCzJJGuzZgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-11-06 01:10:01
UTC ·
(6 days ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇪🇸
pipeline.es
2026-11-05 21:18:26
UTC ·
(6 days ago)
WordPress login brute-force | URL: https://gacetadelturismo.com/wp-login.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-05T21:15:30Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\" ...
show more
WordPress login brute-force | URL: https://gacetadelturismo.com/wp-login.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-05T21:15:30Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\"131.221.48.238\",\"status_code\":503,\"url\":\"https://gacetadelturismo.com/wp-login.php\",\"user_agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:148.0) Gecko/20100101 Firefox/148.0\",\"wfid\":4749698} | ASN: SEMPRE TELECOMUNICACOES LTDA | Country: BR
show less
Brute-Force
🇩🇪
Hazzard
2026-11-05 12:20:25
UTC ·
(1 week ago)
(wordpress) Failed wordpress login from 131.221.48.238 (BR/Brazil/Minas Gerais/Patrocínio/131-221-48-238.sempre.tec.br/[redacted]): (CF_ENABLE)
Brute-Force
🇮🇹
sssrit
2026-11-05 10:22:58
UTC ·
(1 week ago)
131.221.48.238 - - [05/Nov/2026:11:22:57 +0100] "POST /wp-login.php HTTP/2.0" 401 4904 "https://sssr.it/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15"
...
Web App Attack
🇺🇸
johnp
2026-11-05 08:56:59
UTC ·
(1 week ago)
Hostile web requests to a website: /wp-login.php (1 request, 2026-11-05 08:56:59 UTC to 2026-11-05 08:56:59 UTC). User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0
Brute-Force
Web App Attack
🇩🇪
stinpriza
2026-11-04 11:32:28
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇲🇽
octageeks.com
2026-11-04 05:09:06
UTC ·
(1 week ago)
Wordpress malicious attack:[octaflood]
Web App Attack
🇨🇿
Countryman
2026-11-04 01:10:06
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
