🇫🇷
tecnicorioja
2026-11-14 23:01:09
UTC ·
(10 hours ago)
POST /xmlrpc.php [14/Nov/2026:16:16:03
Web App Attack
Brute-Force
🇺🇸
lostswordfish.com
2026-11-14 22:32:03
UTC ·
(10 hours ago)
Wordfence waf block on ncrsol
Web App Attack
🇵🇱
Budyn
2026-11-14 20:39:49
UTC ·
(12 hours ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_1 | Action: AWS API Call | Token ID: jjbmqxvagp71pskep78twdp5w | Client tool: silentvs-hitworker/1
Hacking
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-14 17:02:22
UTC ·
(16 hours ago)
WordPress attack-tool calls | method: POST | path: /xmlrpc.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36
Web App Attack
Hacking
🇳🇱
Alt255
2026-11-13 01:26:22
UTC ·
(2 days ago)
[cb-06al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail nginx-404. Example: 152.245.115.110 - - [13/Nov/2026:02:25:29 +0100] "GET /wp-json/rankmath/v1/getHead?url=https://dansstudioliez.nl HTTP/1.1" 404 134 "-" ...
show more
[cb-06al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail nginx-404. Example: 152.245.115.110 - - [13/Nov/2026:02:25:29 +0100] "GET /wp-json/rankmath/v1/getHead?url=https://dansstudioliez.nl HTTP/1.1" 404 134 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"
152.245.115.110 - - [13/Nov/2026:02:25:36 +0100] "GET /wp-json/elementor/v1/users?per_page=100 HTTP/1.1" 404 134 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"
152.245.115.110 - - [13/Nov/2026:02:25:37 +0100] "GET /wp-json/post-smtp/v1/users?per_page=100 HTTP/1.1" 404 134 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"
152.245.115.110 - - [13/Nov/2026:02:25:38 +0100] "GET /wp-json/wordfence/v1/users?per_pag
...
show less
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-11-12 00:56:10
UTC ·
(3 days ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
cwytech
2026-11-11 12:32:46
UTC ·
(3 days ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-login-lockdown-high.
Bad Web Bot
Web App Attack
🇺🇸
justbible
2026-11-11 02:12:55
UTC ·
(4 days ago)
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 3 requests from 2026-11-11T02:12:55+00:00 to 2026-11-11T03:24:52+00:00, e.g. 'GET /en/kjv,darby,bsb/matt/2/16 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; ...
show more
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 3 requests from 2026-11-11T02:12:55+00:00 to 2026-11-11T03:24:52+00:00, e.g. 'GET /en/kjv,darby,bsb/matt/2/16 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested).
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-11 02:01:05
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 152.245.115.110 (152-245-115-110.user.vivozap.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 21:01:01.276023 2026] [security2:error] [pid 20023:tid 2 ...
show more
(mod_security) mod_security (id:225170) triggered by 152.245.115.110 (152-245-115-110.user.vivozap.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 21:01:01.276023 2026] [security2:error] [pid 20023:tid 20023] [client 152.245.115.110:52756] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||pathpa.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "pathpa.org"] [uri "/wp-json/wp/v2/users"] [unique_id "avPMXUqW9Qeebmc4AOse_wAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 10:20:44
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 152.245.115.110 (152-245-115-110.user.vivozap.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:20:37.022302 2026] [security2:error] [pid 7775:tid 77 ...
show more
(mod_security) mod_security (id:225170) triggered by 152.245.115.110 (152-245-115-110.user.vivozap.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:20:37.022302 2026] [security2:error] [pid 7775:tid 7775] [client 152.245.115.110:45330] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||paguilar.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "paguilar.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avLv9b_A21xDjxJU7bKmoAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
