🇺🇸
mnsf
2026-10-15 03:06:29
(3 days ago)
Too many Status 40X (12)
Brute-Force
Web App Attack
🇺🇸
IndigoRidge
2026-10-14 21:48:43
(3 days ago)
148.227.115.154 - - [14/Oct/2026:17:48:28 -0400] "GET /wp-json/wp/v2/users?per_page=100&_fields=slug ...
show more
148.227.115.154 - - [14/Oct/2026:17:48:28 -0400] "GET /wp-json/wp/v2/users?per_page=100&_fields=slug HTTP/1.1" 403 5500 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
148.227.115.154 - - [14/Oct/2026:17:48:33 -0400] "GET /wp-json/wp/v2/users?context=edit&per_page=100&_fields=slug HTTP/1.1" 403 5500 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
148.227.115.154 - - [14/Oct/2026:17:48:39 -0400] "GET /?author=1&feed=rss2 HTTP/1.1" 404 4761 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
148.227.115.154 - - [14/Oct/2026:17:48:40 -0400] "GET /?author=2&feed=rss2 HTTP/1.1" 404 4761 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
148.227.115.154 - - [14/Oct/2026:17:48:42 -0400] "GET /?author=3&feed=rss2 HTTP/1.1" 40
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 20:44:54
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 148.227.115.154 (customer.sntochl1.isp.starlink ...
show more
(mod_security) mod_security (id:225170) triggered by 148.227.115.154 (customer.sntochl1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 16:44:48.832462 2026] [security2:error] [pid 22208:tid 22208] [client 148.227.115.154:2897] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.plazahacienda.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.plazahacienda.com"] [uri "/wp-json/wp/v2/users"] [unique_id "as_pwGWwgmkSyJoR8D9O0wAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 16:01:49
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 148.227.115.154 (customer.sntochl1.isp.starlink ...
show more
(mod_security) mod_security (id:225170) triggered by 148.227.115.154 (customer.sntochl1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 12:01:41.932974 2026] [security2:error] [pid 857:tid 857] [client 148.227.115.154:31264] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||weightlossover50.customdesignsbybjp.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "weightlossover50.customdesignsbybjp.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "as5V5d_5GEO6gCJUo2B9lAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
saamkuu
2026-10-13 05:47:13
(5 days ago)
DDoS botnet: TCP connection flood, 6 connections to port 443.
DDoS Attack
🇩🇪
Packets-Decreaser.NET
2026-10-12 15:27:52
(6 days ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇨🇦
design2web.ca
2026-09-16 07:07:24
(1 month ago)
[UniFi FW] SSH unauthorized access attempt on port 22 (SSH) | Policy: Region Blocking | Proto: TCP | ...
show more
[UniFi FW] SSH unauthorized access attempt on port 22 (SSH) | Policy: Region Blocking | Proto: TCP | Src: 148.227.115.154:20399 | SrcRegion: CL | Svc: SSH | Detected: 2026-09-16 06:46:27 UTC | ISP: Space Exploration Technologies Corporation | D2W UniFi AbuseIPDB Reporter v2
show less
Port Scan
2026-09-16 04:32:43
(1 month ago)
Network service scanning detected by FortiGate; source quarantined.
Port Scan
2026-09-10 01:12:45
(1 month ago)
denied traffic to a honeypot network. destination port 23.
Port Scan
Hacking
🇩🇪
MusicLibrary
2026-08-27 14:30:15
(1 month ago)
Probing foreign-stack admin panels / known exploit paths (Joomla, phpMyAdmin, phpunit, OWA, etc.)
Bad Web Bot
Web App Attack
🇩🇪
Vegascosmetics
2026-08-15 17:59:34
(2 months ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nest ...
show more
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nesting / CPU-drain risk). Evidence: DEEP ATTACK: Recursive currentUrl nesting detected
show less
Hacking
Exploited Host
Web App Attack
2026-05-07 01:06:09
(5 months ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show more
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-post.asp
show less
Exploited Host
Bad Web Bot
🇺🇸
Smee
2026-03-19 09:58:15
(6 months ago)
IMAP/SMTP Authentication Failure
Brute-Force
🇺🇸
kosada.com
2026-02-28 21:22:09
(7 months ago)
Web bot: DDoS
DDoS Attack
Bad Web Bot
🇦🇹
centurion
2026-02-20 12:46:26
(7 months ago)
Unauthorized attempt on siem [1433/tcp]
Source port: 34437
TTL: 113
Packet length: 52
TOS: 0x00
http ...
show more
Unauthorized attempt on siem [1433/tcp]
Source port: 34437
TTL: 113
Packet length: 52
TOS: 0x00
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
