🇨🇦
polycoda
2026-06-12 14:15:49
(3 months ago)
🥶 Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27
DDoS Attack
2026-04-13 05:35:27
(5 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
2026-04-13 03:49:03
(5 months ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-04-10 09:09:27
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 10 05:09:19.170947 2026] [security2:error] [pid 1870106:tid 1870106] [client 14.139.42.195:20961] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||3beeze.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "3beeze.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adi-P7X57L3HOkn5U-I3vQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-04-10 03:11:21
(5 months ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-04-02 07:46:34
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 03:46:29.335055 2026] [security2:error] [pid 5610:tid 5610] [client 14.139.42.195:12623] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||applemaccomputerconsulting.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "applemaccomputerconsulting.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ac4e1UeDwAKUAQBXzZbUGwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-04-02 03:22:26
(6 months ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 09:28:17
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 05:28:08.071448 2026] [security2:error] [pid 6185:tid 6185] [client 14.139.42.195:9115] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||38floorsupply.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "38floorsupply.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acpCKMVYxOZYrpF8VkKcawAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-03-27 06:00:38
(6 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-25 08:23:22
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 04:23:12.907515 2026] [security2:error] [pid 3657:tid 3657] [client 14.139.42.195:17744] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||casapapayasanmiguel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "casapapayasanmiguel.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acObcPU2VX6vU0vORtFjMQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-25 04:22:35
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 00:22:29.552392 2026] [security2:error] [pid 28553:tid 28553] [client 14.139.42.195:31557] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||enjoymycondos.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "enjoymycondos.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acNjBed256RbD8mnaobDMAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-24 08:44:22
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 24 04:44:16.783971 2026] [security2:error] [pid 26511:tid 26519] [client 14.139.42.195:13992] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hoffmanandassoc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hoffmanandassoc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acJO4NCI4zNnFGgFNuXTKwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
🇨🇭 Hosting
2026-03-24 07:20:02
(6 months ago)
Automated security scanning detected: WordPress XML-RPC exploitation.
Bad Web Bot
Web App Attack
🇺🇸
myagent.site
2026-03-24 06:13:45
(6 months ago)
Blocking for trying to access an exploit file: /xmlrpc.php
Hacking
🇺🇸
TPI-Abuse
2026-03-24 04:41:07
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 14.139.42.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 24 00:40:56.570944 2026] [security2:error] [pid 25140:tid 25140] [client 14.139.42.195:18122] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mariettacaseyclub.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mariettacaseyclub.org"] [uri "/wp-json/wp/v2/users"] [unique_id "acIV2D4SUZJ9suVV14jaqwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack