🇲🇽
octageeks.com
2026-11-07 05:08:37
UTC ·
(1 day ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 23:55:46
UTC ·
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 149.78.7.77 (149-78-7-77.pontonetba.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:55:41.670029 2026] [security2:error] [pid 22794:tid 22794] [cli ...
show more
(mod_security) mod_security (id:225170) triggered by 149.78.7.77 (149-78-7-77.pontonetba.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:55:41.670029 2026] [security2:error] [pid 22794:tid 22794] [client 149.78.7.77:63011] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||drgracetomastolentino.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "drgracetomastolentino.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "au5o_RB5k4fsYHXe_Na7SgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-06 07:50:07
UTC ·
(2 days ago)
| [Dangerous/Brazil] Aggressive IP 149.78.7.77 (~30 hits). Type: DoS Defender- Web server 400 error code
Web App Attack
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-11-06 07:16:27
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 149.78.7.77 (149-78-7-77.pontonetba.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 02:16:22.207713 2026] [security2:error] [pid 11102:tid 11102] [cli ...
show more
(mod_security) mod_security (id:225170) triggered by 149.78.7.77 (149-78-7-77.pontonetba.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 02:16:22.207713 2026] [security2:error] [pid 11102:tid 11102] [client 149.78.7.77:61878] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mail.eatatlotone.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mail.eatatlotone.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au1-xqCeLTNGotesKwgwNgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 18:24:15
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 149.78.7.77 (149-78-7-77.pontonetba.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 13:24:11.227279 2026] [security2:error] [pid 2509660:tid 2510427] ...
show more
(mod_security) mod_security (id:225170) triggered by 149.78.7.77 (149-78-7-77.pontonetba.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 13:24:11.227279 2026] [security2:error] [pid 2509660:tid 2510427] [client 149.78.7.77:62438] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||danelandia.aafm.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "danelandia.aafm.us"] [uri "/wp-json/wp/v2/users/me"] [unique_id "auzJy7cYkTZapUkmfc0YygAAAc4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-11-05 01:10:01
UTC ·
(3 days ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇹🇷
Jova
2026-11-04 13:55:38
UTC ·
(4 days ago)
WordPress user enumeration: 5 requests.
Web App Attack
🇨🇭
SOC [GOLINE SA]
2026-11-04 07:15:23
UTC ·
(4 days ago)
[RoutePulse | 2026-11-04T07:15:23Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 149.78.7.77
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — slow spray: 3 failed logins over 15 h (one every ~450 min, ...
show more
[RoutePulse | 2026-11-04T07:15:23Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 149.78.7.77
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — slow spray: 3 failed logins over 15 h (one every ~450 min, under every 15-min threshold and the FTD hold-down) — rung 1-bis (doc 247 §10.2)
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
Brute-Force
Hacking
🇩🇪
big-cloud.nl
2026-11-03 21:39:06
UTC ·
(4 days ago)
Try to access /xmlrpc.php
Web App Attack
🇲🇹
Malta
2026-11-02 18:06:25
UTC ·
(6 days ago)
149.78.7.77 - - [02/Nov/2026:19:06:25 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36"
Brute-force password attempt
Hacking
Web App Attack
Brute-Force
🇨🇿
lp
2026-11-02 09:33:29
UTC ·
(6 days ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 149.78.7.77
2026-11-02T10:13:13+0100 vpn Access-Reject station: 149.78.7.77
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-11-01 01:10:02
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇫🇷
ELYAZ
2026-10-31 23:02:25
UTC ·
(1 week ago)
(y3) Failed access -byebye- from 149.78.7.77 (BR/Brazil/149-78-7-77.pontonetba.com.br): (CF_ENABLE)
Hacking
🇫🇷
MatStef132
2026-07-18 19:20:33
UTC ·
(3 months ago)
MatShield L7: blocked on mathost.eu (ua-quarantined)
Bad Web Bot
🇺🇸
TPI-Abuse
2024-09-25 03:03:01
UTC ·
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 149.78.7.77 (149-78-7-77.pontonetba.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 24 23:02:54.077893 2024] [security2:error] [pid 16630:tid 16630] [cli ...
show more
(mod_security) mod_security (id:225170) triggered by 149.78.7.77 (149-78-7-77.pontonetba.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 24 23:02:54.077893 2024] [security2:error] [pid 16630:tid 16630] [client 149.78.7.77:32620] [client 149.78.7.77] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||modmove.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "modmove.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "ZvN9Xl9JYfPFuNn5YWYytQAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
