2026-11-12 21:12:21
UTC ·
(20 hours ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
2026-11-10 20:56:54
UTC ·
(2 days ago)
2026-11-10T21:56:53.071126+01:00 aion wordpress[736384]: Blocked user enumeration attempt from 131.72.252.124
...
Hacking
Brute-Force
🇲🇽
octageeks.com
2026-11-07 05:08:41
UTC ·
(6 days ago)
Wordpress malicious attack:[octawpauthor]
Web App Attack
2026-11-06 07:15:04
UTC ·
(1 week ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Blocked by User-Agent Filter (Bad Bot Pattern: MSIE 6.): Mozilla/5.0 (compatible; MSIE 6.0; Windows 95; Trident/5.0) | UA: Mozilla/5.0 (compatible; MSIE 6.0; Windows 95; Trident/5.0) | (Magento Site)
show less
Hacking
Bad Web Bot
🇨🇿
lp
2026-11-04 06:02:52
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 131.72.252.124
2026-11-04T06:53:21+0100 vpn Access-Reject station: 131.72.252.124
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 08:59:57
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 131.72.252.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 04:59:51.392556 2026] [security2:error] [pid 7213:tid 7213] [client 131.72.252.124:7874] Mo ...
show more
(mod_security) mod_security (id:225170) triggered by 131.72.252.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 04:59:51.392556 2026] [security2:error] [pid 7213:tid 7213] [client 131.72.252.124:7874] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||aholsniffsglue.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aholsniffsglue.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "auWuB5WU8xvPOP7hMEK69gAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-10-31 01:10:01
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
Ben Schoolland
2026-10-30 22:10:31
UTC ·
(1 week ago)
WordPress credential-stuffing: POST /wp-login.php to chalkwild.com at 30/Oct/2026:18:35:03 UTC, HTTP 200 (login form re-rendered = credentials rejected, 7119 bytes). This IP's ONLY request in our entire 888,616-line 90-day access log is this single l ...
show more
WordPress credential-stuffing: POST /wp-login.php to chalkwild.com at 30/Oct/2026:18:35:03 UTC, HTTP 200 (login form re-rendered = credentials rejected, 7119 bytes). This IP's ONLY request in our entire 888,616-line 90-day access log is this single login POST - it never fetched the login page, any CSS/JS/image, or any other URL, so no browser ever rendered the form. One of 85 distinct IPs that each sent exactly one such POST today between 04:06 and 21:55 UTC, paced ~12 min apart with rotating desktop/mobile User-Agents and an identical hardcoded Referer - a distributed login brute-force deliberately kept to one attempt per host to stay under rate-limit thresholds. No successful authentication occurred.
show less
Brute-Force
Web App Attack
2026-10-30 07:49:27
UTC ·
(2 weeks ago)
"POST /xmlrpc.php HTTP/1.1"
Hacking
Web App Attack
🇩🇪
FeG Deutschland
2026-10-30 02:38:42
UTC ·
(2 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 19:21:12
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:225170) triggered by 131.72.252.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 15:21:00.020892 2026] [security2:error] [pid 15844:tid 15844] [client 131.72.252.124:7587] ...
show more
(mod_security) mod_security (id:225170) triggered by 131.72.252.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 15:21:00.020892 2026] [security2:error] [pid 15844:tid 15844] [client 131.72.252.124:7587] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lightningbug.farm|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lightningbug.farm"] [uri "/wp-json/wp/v2/users"] [unique_id "as_WHO7qrdz67_ekBWlvKgAAABw"], referer: https://lightningbug.farm/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-10-02 03:20:15
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Bad Web Bot
🇨🇿
lp
2026-10-01 01:51:15
UTC ·
(1 month ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 131.72.252.124
2026-10-01T03:00:17+02:00 vpn Access-Reject 'xrezl04' station: 131.72.252.124 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redac ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 131.72.252.124
2026-10-01T03:00:17+02:00 vpn Access-Reject 'xrezl04' station: 131.72.252.124 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇺🇸
kosada.com
2026-08-27 21:29:19
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
2026-02-13 22:20:57
UTC ·
(8 months ago)
botnet
DDoS Attack
