🇩🇪
ghostwarriors
2026-11-10 09:50:35
UTC ·
(5 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-10 09:46:09
UTC ·
(5 days ago)
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0 ...
show more
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Sa
Requested, e.g.:
- wordpress.[REDACTED]/wp-admin/
show less
Web App Attack
🇩🇪
McClay
2026-11-09 09:45:15
UTC ·
(6 days ago)
Illegal access attempt:138.219.57.9 - - [09/Nov/2026:10:45:14 +0100] "GET /wp-login.php HTTP/1.1" 404 937 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36"
...
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 18:45:17
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 138.219.57.9 (ip-138-219-57-9.miinternet.cl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 13:45:11.858622 2026] [security2:error] [pid 31612:tid 31612] [cl ...
show more
(mod_security) mod_security (id:225170) triggered by 138.219.57.9 (ip-138-219-57-9.miinternet.cl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 13:45:11.858622 2026] [security2:error] [pid 31612:tid 31612] [client 138.219.57.9:43660] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||summit1000.group|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "summit1000.group"] [uri "/wp-json/wp/v2/users/me"] [unique_id "au9xtxlaX9JE6f34gC5hBwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
Jova
2026-11-06 08:53:49
UTC ·
(1 week ago)
WordPress user enumeration: 5 requests.
Web App Attack
🇬🇧
spamverify.com
2026-11-05 10:19:13
UTC ·
(1 week ago)
Honeypot Hit: xmlrpc.php
Web Spam
Blog Spam
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-11-05 01:10:01
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-11-05 00:42:29
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 138.219.57.9 (ip-138-219-57-9.miinternet.cl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 19:42:22.806206 2026] [security2:error] [pid 3930498:tid 3930523] ...
show more
(mod_security) mod_security (id:225170) triggered by 138.219.57.9 (ip-138-219-57-9.miinternet.cl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 19:42:22.806206 2026] [security2:error] [pid 3930498:tid 3930523] [client 138.219.57.9:35372] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||danelandia.aafm.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "danelandia.aafm.us"] [uri "/wp-json/wp/v2/users/me"] [unique_id "auvQ7v8kO7u-GLpZOJowhwAAARQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-11-03 01:10:02
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-10-31 01:10:01
UTC ·
(2 weeks ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-10-30 14:33:24
UTC ·
(2 weeks ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 138.219.57.9
2026-10-30T15:12:29+0100 vpn Access-Reject station: 138.219.57.9
Brute-Force
Web App Attack
🇩🇪
FeG Deutschland
2026-10-30 03:46:54
UTC ·
(2 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
2026-10-30 00:00:42
UTC ·
(2 weeks ago)
Web probing (3 hits in 24h) on default-vhost,helenehoenjet.nl: sensitive-path scans and/or 404 bursts. Reported by CRMON.
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 19:04:36
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 138.219.57.9 (ip-138-219-57-9.miinternet.cl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 15:04:29.314830 2026] [security2:error] [pid 29925:tid 29925] [cl ...
show more
(mod_security) mod_security (id:225170) triggered by 138.219.57.9 (ip-138-219-57-9.miinternet.cl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 15:04:29.314830 2026] [security2:error] [pid 29925:tid 29925] [client 138.219.57.9:56126] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||usaenquirer.com.bamedica.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "usaenquirer.com.bamedica.com"] [uri "/wp-json/wp/v2/users"] [unique_id "auOYvdkdgOTeivq9DZBSbAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇽
octageeks.com
2026-10-28 04:17:21
UTC ·
(2 weeks ago)
Wordpress malicious attack:[octawp]
Web App Attack
