🇺🇸
TPI-Abuse
2026-10-12 09:37:55
(1 hour ago)
(mod_security) mod_security (id:225170) triggered by 139.59.18.181 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 139.59.18.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 05:37:47.618867 2026] [security2:error] [pid 11974:tid 11974] [client 139.59.18.181:55514] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.crystaljohns.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.crystaljohns.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "asyqaze9rj7RrU_5CIx5OAAAADg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-10-12 09:15:57
(1 hour ago)
Repeated requests for suspicious nonexistent URLs, for example: /website/wp-includes/wlwmanifest.xml ...
show more
Repeated requests for suspicious nonexistent URLs, for example: /website/wp-includes/wlwmanifest.xml (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36")
show less
Web App Attack
🇨🇦
KIsmay
2026-10-12 09:12:37
(1 hour ago)
2026-10-12T05:12:34.242684-04:00 www4 WPAudit[2110535]: 139.59.18.181 bcadjuster.com "Mozilla/5.0 (W ...
show more
2026-10-12T05:12:34.242684-04:00 www4 WPAudit[2110535]: 139.59.18.181 bcadjuster.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" tony:!@#$%^ FAIL
2026-10-12T05:12:34.887227-04:00 www4 WPAudit[2110535]: 139.59.18.181 bcadjuster.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" tony:0000 FAIL
2026-10-12T05:12:35.547199-04:00 www4 WPAudit[2110535]: 139.59.18.181 bcadjuster.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" tony:00000 FAIL
2026-10-12T05:12:36.195960-04:00 www4 WPAudit[2110535]: 139.59.18.181 bcadjuster.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" tony:000000 FAIL
2026-10-12T05:12:36.827364-04:00 www4 WPAudit[2110535]: 139.59.18.181 bcadjuster.com "Mozilla/5.0 (Windows NT 10.0; Win64;
...
show less
Brute-Force
Web App Attack
🇩🇪
LRob
2026-10-12 08:07:07
(2 hours ago)
Web exploit attempt | method: GET | path: // | query: author=1, author=2 | ua: Mozilla/5.0 (Windows ...
show more
Web exploit attempt | method: GET | path: // | query: author=1, author=2 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 05:51:38
(5 hours ago)
(mod_security) mod_security (id:225170) triggered by 139.59.18.181 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 139.59.18.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 01:51:31.501534 2026] [security2:error] [pid 29140:tid 29140] [client 139.59.18.181:65401] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||modestosoftwater.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "modestosoftwater.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "asx1Y0PxcBh7JTEsbbKxQwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
maxxsense
2026-10-12 05:26:54
(5 hours ago)
(wordpress) Failed wordpress login from 139.59.18.181 (IN/India/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-10-12 05:20:47
(5 hours ago)
(mod_security) mod_security (id:225170) triggered by 139.59.18.181 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 139.59.18.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 01:20:42.085064 2026] [security2:error] [pid 29645:tid 29645] [client 139.59.18.181:49196] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nolaanime.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nolaanime.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "asxuKhNsu27Kj7AblvOgIAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-10-12 02:56:31
(8 hours ago)
(PERMBLOCK) 139.59.18.181 (IN/India/-) has had more than 4 temp blocks in the last 86400 secs (0-197 ...
show more
(PERMBLOCK) 139.59.18.181 (IN/India/-) has had more than 4 temp blocks in the last 86400 secs (0-197)
show less
Hacking
🇫🇷
masterguru
2026-10-12 01:42:16
(9 hours ago)
(wordpress) Apache: Failed WordPress login from 139.59.18.181 (IN/India/-): 10 in the last 3600 secs ...
show more
(wordpress) Apache: Failed WordPress login from 139.59.18.181 (IN/India/-): 10 in the last 3600 secs (0-193)
show less
Hacking
🇳🇱
e.fierstra
2026-10-12 01:35:14
(9 hours ago)
excessive HTTP 404 errors
Bad Web Bot
🇫🇷
masterguru
2026-10-12 01:24:15
(9 hours ago)
(wordpress) Apache: Failed WordPress login from 139.59.18.181 (IN/India/-): 10 in the last 3600 secs ...
show more
(wordpress) Apache: Failed WordPress login from 139.59.18.181 (IN/India/-): 10 in the last 3600 secs (0-196)
show less
Hacking
🇺🇸
TPI-Abuse
2026-10-12 01:21:10
(9 hours ago)
(mod_security) mod_security (id:225170) triggered by 139.59.18.181 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 139.59.18.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 21:21:06.278811 2026] [security2:error] [pid 9671:tid 9671] [client 139.59.18.181:50667] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.theamarals.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.theamarals.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "asw2AhywZzeY9ZFxE3IN4AAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-10-12 01:05:18
(9 hours ago)
Abuse Detected (9)
Brute-Force
Web App Attack
🇺🇸
dot.mg
2026-10-12 00:33:04
(10 hours ago)
Bad behaviour
Web Spam
🇩🇪
lolyay
2026-10-12 00:26:52
(10 hours ago)
139.59.18.181 - - [12/Oct/2026:00:26:51 +0000] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 200 4 "-" ...
show more
139.59.18.181 - - [12/Oct/2026:00:26:51 +0000] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 200 4 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
139.59.18.181 - - [12/Oct/2026:00:26:51 +0000] "GET /xmlrpc.php?rsd HTTP/1.1" 200 4 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
...
show less
Web App Attack
Bad Web Bot
