🇺🇸
TPI-Abuse
2026-05-22 14:01:20
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 22 10:01:10.289032 2026] [security2:error] [pid 20026:tid 20026] [client 140.235.2.90:36369] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "barecreationsaz.com"] [uri "/wp-config.php.bak"] [unique_id "ahBhpv3ZejLAH6fpzS3oiwAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-22 13:36:27
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 22 09:36:18.416213 2026] [security2:error] [pid 10051:tid 10051] [client 140.235.2.90:27189] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "major33.com"] [uri "/wp-config.php.bak"] [unique_id "ahBb0hfe3vJzeSfOm7UD6AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-22 12:45:51
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 22 08:45:43.632561 2026] [security2:error] [pid 9800:tid 9800] [client 140.235.2.90:42079] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||professionalpianomoversinc.com.anthonyanimalclinic.net|F|2"] [data ".inc"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "professionalpianomoversinc.com.anthonyanimalclinic.net"] [uri "/wp-config.inc"] [unique_id "ahBP9zU1UgUI8T335Rfn3wAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-21 22:34:49
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 18:34:40.818716 2026] [security2:error] [pid 28843:tid 28843] [client 140.235.2.90:49017] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.manosentuayuda.imerka.com.mx"] [uri "/wp-config.php.dist"] [unique_id "ag-IgH_2EKGhcURl8C44twAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 20:12:25
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 16:12:14.387352 2026] [security2:error] [pid 10553:tid 10553] [client 140.235.2.90:33477] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "indiahouseportland.com"] [uri "/wp-config.php.save"] [unique_id "ag4VnjshLUrDEz5BoXliBQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 18:02:29
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 14:02:20.722126 2026] [security2:error] [pid 10039:tid 10039] [client 140.235.2.90:29071] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cms2020.com"] [uri "/wp-config.php.dist"] [unique_id "ag33LBneAdtM-5Ddv6SkVwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 16:23:25
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 140.235.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 12:23:18.345749 2026] [security2:error] [pid 16501:tid 16501] [client 140.235.2.90:21231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "persnicketyinc.com"] [uri "/wp-config.php.save"] [unique_id "ag3f9mTwrXC9S1M_HCNrjQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
sshtmp
2026-05-20 04:04:15
(2 weeks ago)
[AbuseIPDB auto-report]
Attack: WordPress XML-RPC brute-force
Hits: 1 | First: 2026-05-20T06:04:15+0 ...
show more
[AbuseIPDB auto-report]
Attack: WordPress XML-RPC brute-force
Hits: 1 | First: 2026-05-20T06:04:15+02:00 | Last: 2026-05-20T06:04:15+02:00
Samples: POST /xmlrpc.php [200]
show less
Brute-Force
Web App Attack
🇺🇸
antlac1
2026-05-17 20:59:30
(2 weeks ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇲🇹
Malta
2026-05-17 16:18:09
(2 weeks ago)
140.235.2.90 - - [17/May/2026:18:18:09 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; I ...
show more
140.235.2.90 - - [17/May/2026:18:18:09 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
show less
Hacking
Web App Attack
VPN IP
🇫🇷
dynamix
2026-04-17 06:36:43
(1 month ago)
Multiple WAF Violations
Web App Attack
🇩🇪
stinpriza
2026-04-14 21:42:04
(1 month ago)
Web App Attack
Web App Attack
2026-02-01 06:45:10
(4 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2026.02.01 is noted in report tim ...
show more
Attempted brute force login to web vpn 1 time(s); last attempt for 2026.02.01 is noted in report timestamp
show less
Hacking
Brute-Force
2026-01-19 21:46:39
(4 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2026.01.19 is noted in report tim ...
show more
Attempted brute force login to web vpn 1 time(s); last attempt for 2026.01.19 is noted in report timestamp
show less
Hacking
Brute-Force
2026-01-19 00:00:00
(4 months ago)
Brute force against VPN
Brute-Force
Bad Web Bot