🇧🇷
ICS Labs
2026-06-30 13:40:50
UTC ·
(4 months ago)
ICS Labs identified 141.94.18.111 as a malicious indicator from threat intelligence.
DDoS Attack
Port Scan
Hacking
Brute-Force
Exploited Host
🇺🇸
TPI-Abuse
2026-05-16 09:17:26
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 141.94.18.111 (sylvite.zerodeux.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 05:17:18.748497 2026] [security2:error] [pid 4146:tid 4146] [client 141.9 ...
show more
(mod_security) mod_security (id:225170) triggered by 141.94.18.111 (sylvite.zerodeux.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 05:17:18.748497 2026] [security2:error] [pid 4146:tid 4146] [client 141.94.18.111:57118] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.misogynyis.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.misogynyis.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agg2HpbebGGXHgtQaKV1fwAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-14 21:04:04
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 141.94.18.111 (sylvite.zerodeux.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 17:04:00.725359 2026] [security2:error] [pid 23117:tid 23117] [client 141 ...
show more
(mod_security) mod_security (id:225170) triggered by 141.94.18.111 (sylvite.zerodeux.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 17:04:00.725359 2026] [security2:error] [pid 23117:tid 23117] [client 141.94.18.111:50294] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thingstodonude.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thingstodonude.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agY4wC1X4LCrBG0iKbP5owAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-14 17:28:14
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 141.94.18.111 (sylvite.zerodeux.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 13:28:07.170024 2026] [security2:error] [pid 15499:tid 15499] [client 141 ...
show more
(mod_security) mod_security (id:225170) triggered by 141.94.18.111 (sylvite.zerodeux.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 13:28:07.170024 2026] [security2:error] [pid 15499:tid 15499] [client 141.94.18.111:53356] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rambleandprose.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rambleandprose.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agYGJ4zFTFEH2F-pU-Ct6AAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
masterguru
2026-05-14 16:23:54
UTC ·
(5 months ago)
WordPress: User enumeration. Pattern match "(author\\\\= (1000-123)
Web App Attack
🇺🇸
TPI-Abuse
2026-05-14 13:47:21
UTC ·
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 141.94.18.111 (sylvite.zerodeux.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 09:47:16.595834 2026] [security2:error] [pid 21742:tid 21742] [client 141 ...
show more
(mod_security) mod_security (id:225170) triggered by 141.94.18.111 (sylvite.zerodeux.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 09:47:16.595834 2026] [security2:error] [pid 21742:tid 21742] [client 141.94.18.111:57992] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||applemaccomputerconsulting.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "applemaccomputerconsulting.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agXSZFCMImYK3fjNm-y5sAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-12 19:20:32
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 141.94.18.111 (sylvite.zerodeux.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 15:20:24.784561 2026] [security2:error] [pid 4646:tid 4646] [client 141.9 ...
show more
(mod_security) mod_security (id:225170) triggered by 141.94.18.111 (sylvite.zerodeux.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 15:20:24.784561 2026] [security2:error] [pid 4646:tid 4646] [client 141.94.18.111:56924] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||dvdmasters.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dvdmasters.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agN9eIJMmxOb-MwxUsbUnAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-12 12:43:49
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 141.94.18.111 (sylvite.zerodeux.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 08:43:43.484263 2026] [security2:error] [pid 6607:tid 6607] [client 141.9 ...
show more
(mod_security) mod_security (id:225170) triggered by 141.94.18.111 (sylvite.zerodeux.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 08:43:43.484263 2026] [security2:error] [pid 6607:tid 6607] [client 141.94.18.111:35214] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.clayrivers.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.clayrivers.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agMgfy7fPiN9-EgjBGux3wAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
SpaceHost-Server
2026-05-02 22:31:14
UTC ·
(6 months ago)
Brute-Force
Web App Attack
🇩🇪
LRob
2026-04-30 07:15:05
UTC ·
(6 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-04-29 09:00:09
UTC ·
(6 months ago)
WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail
Brute-Force
Web App Attack
🇩🇪
Hazzard
2026-04-29 08:58:09
UTC ·
(6 months ago)
(wordpress) Failed wordpress login from 141.94.18.111 (FR/France/-/-/sylvite.zerodeux.net/[redacted]): (CF_ENABLE)
Brute-Force
🇫🇷
ingroscart.it
2026-04-29 07:52:13
UTC ·
(6 months ago)
(wordpress) Failed wordpress login from 141.94.18.111 (FR/France/sylvite.zerodeux.net)
Brute-Force
🇩🇪
iNetWorker
2026-04-29 05:27:18
UTC ·
(6 months ago)
trolling for resource vulnerabilities
Web App Attack
🇺🇸
octageeks.com
2026-04-29 04:08:51
UTC ·
(6 months ago)
Wordpress malicious attack:[octausername]
Web App Attack