🇺🇸
TPI-Abuse
2026-11-06 15:50:21
UTC ·
(7 hours ago)
(mod_security) mod_security (id:225170) triggered by 138.36.97.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 10:50:17.048273 2026] [security2:error] [pid 18315:tid 18318] [client 138.36.97.225:39282] M ...
show more
(mod_security) mod_security (id:225170) triggered by 138.36.97.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 10:50:17.048273 2026] [security2:error] [pid 18315:tid 18318] [client 138.36.97.225:39282] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||sloveniaflyfishing.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sloveniaflyfishing.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au33OfeAlStpIq-bSYx6fwAAAEE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-11-06 01:10:01
UTC ·
(21 hours ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-11-05 17:18:02
UTC ·
(1 day ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 138.36.97.225
2026-11-05T17:57:40+0100 vpn Access-Reject station: 138.36.97.225
Brute-Force
Web App Attack
🇲🇹
Malta
2026-10-30 23:47:41
UTC ·
(6 days ago)
138.36.97.225 - - [31/Oct/2026:00:47:41 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36"
Hacking
Web App Attack
🇨🇿
lp
2026-10-30 15:33:21
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 138.36.97.225
2026-10-30T16:20:38+0100 vpn Access-Reject station: 138.36.97.225
Brute-Force
Web App Attack
🇬🇧
gigatech
2026-10-28 05:35:04
UTC ·
(1 week ago)
Webserver Probing
Web App Attack
🇩🇪
LRob
2026-10-27 05:38:42
UTC ·
(1 week ago)
Proxynvader botnet: shop search flood (L7 DDoS) | path: /196-velo-tout-chemin-electrique | query: order=product.name.desc&q=Selections-Promo/Taille-S | src_port: 57924 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge ...
show more
Proxynvader botnet: shop search flood (L7 DDoS) | path: /196-velo-tout-chemin-electrique | query: order=product.name.desc&q=Selections-Promo/Taille-S | src_port: 57924 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36 | 2026-10-27 05:38 UTC
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 11:38:58
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 138.36.97.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 07:38:50.010561 2026] [security2:error] [pid 1435:tid 1435] [client 138.36.97.225:40830] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 138.36.97.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 07:38:50.010561 2026] [security2:error] [pid 1435:tid 1435] [client 138.36.97.225:40830] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||artigelisim.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "artigelisim.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "at87ynI0cb0nsTn-WF3AfwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 15:06:33
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 138.36.97.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 11:06:27.670614 2026] [security2:error] [pid 7710:tid 7710] [client 138.36.97.225:44850] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 138.36.97.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 11:06:27.670614 2026] [security2:error] [pid 7710:tid 7710] [client 138.36.97.225:44850] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.danielbrower.circleofsound.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.danielbrower.circleofsound.org"] [uri "/wp-json/wp/v2/users"] [unique_id "atzJc0rNZPpBBpOdsHHZTgAAAA4"], referer: https://www.danielbrower.circleofsound.org/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 04:52:19
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 138.36.97.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 00:52:12.618209 2026] [security2:error] [pid 10246:tid 10246] [client 138.36.97.225:54876] M ...
show more
(mod_security) mod_security (id:225170) triggered by 138.36.97.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 00:52:12.618209 2026] [security2:error] [pid 10246:tid 10246] [client 138.36.97.225:54876] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||egelfitness.nl|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "egelfitness.nl"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atrn_O0zyoOsTnyi2s6CEgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-10-22 21:18:14
UTC ·
(2 weeks ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 02:23:44
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 138.36.97.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 22:23:38.225475 2026] [security2:error] [pid 31886:tid 31886] [client 138.36.97.225:56276] M ...
show more
(mod_security) mod_security (id:225170) triggered by 138.36.97.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 22:23:38.225475 2026] [security2:error] [pid 31886:tid 31886] [client 138.36.97.225:56276] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||iostation.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "iostation.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atlzqkSgI592REY6IdB_9AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-20 13:29:40
UTC ·
(2 weeks ago)
Not following 301 redirects — wasted requests | host: fleuvefestival.org | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 | src_port: 51180
Bad Web Bot
🇺🇸
鬼影233
2026-09-25 02:28:30
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-21 14:56:10
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
