🇩🇪
georgengelmann
2026-11-13 09:55:03
UTC ·
(2 days ago)
Failed login attempt for yuanping
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 02:04:46
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 142.188.136.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:04:41.103466 2026] [security2:error] [pid 26715:tid 26715] [client 142.188.136.19:44464] ...
show more
(mod_security) mod_security (id:225170) triggered by 142.188.136.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:04:41.103466 2026] [security2:error] [pid 26715:tid 26715] [client 142.188.136.19:44464] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||acarsubscription.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "acarsubscription.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avZwOXAR6oMMlQnoNkACXgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 00:21:22
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 142.188.136.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:21:14.896151 2026] [security2:error] [pid 16781:tid 16781] [client 142.188.136.19:46368] ...
show more
(mod_security) mod_security (id:225170) triggered by 142.188.136.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:21:14.896151 2026] [security2:error] [pid 16781:tid 16781] [client 142.188.136.19:46368] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cassimandabdallah.williamgilcher.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cassimandabdallah.williamgilcher.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avZX-pi8ztGsVcWkN8mbsgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
thesimonmanuel
2026-11-12 23:48:12
UTC ·
(2 days ago)
142.188.136.19 - - [13/Nov/2026:05:18:12 +0530] "GET /?author=1&feed=rss2 HTTP/1.1" 301 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 14:34:06
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 142.188.136.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 09:34:02.113084 2026] [security2:error] [pid 21101:tid 21101] [client 142.188.136.19:42688] ...
show more
(mod_security) mod_security (id:225170) triggered by 142.188.136.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 09:34:02.113084 2026] [security2:error] [pid 21101:tid 21101] [client 142.188.136.19:42688] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||medusakenya.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "medusakenya.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avXOWlShT59y3dAL5YqcIQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
ICS Labs
2026-11-11 17:16:49
UTC ·
(3 days ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-11 UTC.
Brute-Force
🇺🇸
dtorrer
2026-11-11 14:39:13
UTC ·
(3 days ago)
Brute-force general attack.
Brute-Force
🇺🇸
TPI-Abuse
2026-11-11 00:19:21
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 142.188.136.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:19:14.619376 2026] [security2:error] [pid 6585:tid 6585] [client 142.188.136.19:35314] M ...
show more
(mod_security) mod_security (id:225170) triggered by 142.188.136.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:19:14.619376 2026] [security2:error] [pid 6585:tid 6585] [client 142.188.136.19:35314] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cienmalos.hodlmoser.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cienmalos.hodlmoser.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avO0gq3k5ikXI7kFo6Q_2AAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-11-10 18:50:16
UTC ·
(4 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-10 18:29:56
UTC ·
(4 days ago)
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0 ...
show more
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Sa
Requested, e.g.:
- sonarqube.[REDACTED]/xmlrpc.php
show less
Web App Attack
🇲🇹
Malta
2026-11-10 03:19:58
UTC ·
(5 days ago)
142.188.136.19 - - [10/Nov/2026:04:19:57 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15"
Brute-force password attempt
Hacking
Web App Attack
Brute-Force
🇺🇸
computertrendz
2026-11-09 02:30:10
UTC ·
(6 days ago)
Blocked by os-abuseipdb; 7 hits, proto=udp, ports=443
Port Scan
Hacking
🇩🇪
LRob
2026-11-08 18:31:39
UTC ·
(6 days ago)
WordPress attack-tool calls | method: POST | path: /xmlrpc.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36
Web App Attack
Hacking
🇩🇪
Hazzard
2026-11-08 12:42:39
UTC ·
(6 days ago)
(wordpress) Failed wordpress login from 142.188.136.19 (CA/Canada/Ontario/Scarborough/-/[redacted]): (CF_ENABLE)
Brute-Force
🇺🇸
justbible
2026-11-07 23:34:07
UTC ·
(1 week ago)
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 3 requests from 2026-11-07T23:34:07+00:00 to 2026-11-08T18:24:10+00:00, e.g. 'GET /en/original,kjv/matt/10/37 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; ...
show more
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 3 requests from 2026-11-07T23:34:07+00:00 to 2026-11-08T18:24:10+00:00, e.g. 'GET /en/original,kjv/matt/10/37 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested).
show less
Bad Web Bot
