🇩🇪
LRob
2026-11-07 06:16:26
UTC ·
(1 day ago)
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/blame/commit/da0fe52abc246424e959843f94e57a308a7c3666/internal/api/origin_test.go | src_port: 44100 | ua: Mozilla/5.0 (Window ...
show more
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/blame/commit/da0fe52abc246424e959843f94e57a308a7c3666/internal/api/origin_test.go | src_port: 44100 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
show less
DDoS Attack
Bad Web Bot
🇺🇸
鬼影233
2026-09-24 11:23:40
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-23 11:21:31
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-23 08:13:03
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Bad Web Bot
🇺🇸
integrantservices.com
2026-08-07 13:01:12
UTC ·
(3 months ago)
(wordpress) Failed wordpress login from 146.196.32.27 (IN/India/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-08-07 09:17:04
UTC ·
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 146.196.32.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 05:16:56.491780 2026] [security2:error] [pid 385982:tid 385982] [client 146.196.32.27:57457] ...
show more
(mod_security) mod_security (id:240335) triggered by 146.196.32.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 05:16:56.491780 2026] [security2:error] [pid 385982:tid 385982] [client 146.196.32.27:57457] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 146.196.32.27 (+1 hits since last alert)|nancyscafeandcatering.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nancyscafeandcatering.com"] [uri "/xmlrpc.php"] [unique_id "anWiiMlTHIwJhHYMy_emsQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-07 09:12:03
UTC ·
(3 months ago)
[redacted] 146.196.32.27 - - [07/Aug/2026:11:11:07 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 146.196.32.27 - - [07/Aug/2026:11:11:18 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by Wo ...
show more
[redacted] 146.196.32.27 - - [07/Aug/2026:11:11:07 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 146.196.32.27 - - [07/Aug/2026:11:11:18 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.3)"
[redacted] 146.196.32.27 - - [07/Aug/2026:11:11:30 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/13.0; WordPress/6.1; http://site24066783.com"
[redacted] 146.196.32.27 - - [07/Aug/2026:11:11:50 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2)"
[redacted] 146.196.32.27 - - [07/Aug/2026:11:12:02 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
...
show less
Hacking
Web App Attack
2026-08-07 08:41:04
UTC ·
(3 months ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-06 11:28:18
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 146.196.32.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 06 07:28:10.869921 2026] [security2:error] [pid 903007:tid 903016] [client 146.196.32.27:57137] ...
show more
(mod_security) mod_security (id:225170) triggered by 146.196.32.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 06 07:28:10.869921 2026] [security2:error] [pid 903007:tid 903016] [client 146.196.32.27:57137] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||kemalinal.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "kemalinal.com"] [uri "/wp-json/wp/v2/users"] [unique_id "anRvyvaeoepmFp3qpvCqXAAAAQU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-08-06 11:20:03
UTC ·
(3 months ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇨🇭
4server
2026-08-06 11:13:32
UTC ·
(3 months ago)
[ThuAug0613:13:28.6094002026][security2:error][pid1396480:tid1396684][client146.196.32.27:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\" ...
show more
[ThuAug0613:13:28.6094002026][security2:error][pid1396480:tid1396684][client146.196.32.27:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"associazione-iris.ch\"][uri\"/xmlrpc.php\"][unique_id\"anRsWLKFT6KkDPlDh76ZlQAAAoQ\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-06 09:44:40
UTC ·
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 146.196.32.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 06 05:44:32.286633 2026] [security2:error] [pid 852272:tid 852272] [client 146.196.32.27:57008] ...
show more
(mod_security) mod_security (id:240335) triggered by 146.196.32.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 06 05:44:32.286633 2026] [security2:error] [pid 852272:tid 852272] [client 146.196.32.27:57008] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 146.196.32.27 (+1 hits since last alert)|ubuciko.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ubuciko.com"] [uri "/xmlrpc.php"] [unique_id "anRXgIVCx5MC7QNkQvwAewAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-07-15 18:32:33
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇮🇹
VHosting
2025-12-23 12:10:05
UTC ·
(10 months ago)
Detected attack and reported by a human
DDoS Attack
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
🇳🇱
exxos
2025-08-01 02:54:24
UTC ·
(1 year ago)
HTTP1.x attacks
DDoS Attack
