🇪🇸
gnom4ik
2026-02-21 14:46:49
(4 months ago)
ban-reviewer auto report; ip=154.213.163.182; scenario=http:scan; verdict=valid_ban; confidence=0.85 ...
show more
ban-reviewer auto report; ip=154.213.163.182; scenario=http:scan; verdict=valid_ban; confidence=0.85; categories=14,15,18; active_decisions=1; lookback_decisions=1; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=IP flagged for HTTP scan activity; Decision made by CAPI with 8040 minute duration; Appears to be a sustained scanning pattern based on time window
show less
Port Scan
Hacking
Brute-Force
2026-01-14 14:40:56
(5 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇮🇹
VHosting
2025-12-23 20:20:12
(6 months ago)
Detected attack and reported by a human
DDoS Attack
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
🇩🇪
Holger
2025-11-24 08:41:34
(7 months ago)
Bruteforce WebAttack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 07:54:16
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 154.213.163.182 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 154.213.163.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:54:10.368888 2025] [security2:error] [pid 32698:tid 32698] [client 154.213.163.182:36679] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.ferrarapanent.com"] [uri "/.git/HEAD"] [unique_id "aSQPIrPU3H-SnOvN_R8oWAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 07:20:31
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 154.213.163.182 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 154.213.163.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:20:24.028164 2025] [security2:error] [pid 25477:tid 25477] [client 154.213.163.182:45171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.aiamur.com"] [uri "/.git/HEAD"] [unique_id "aSQHOMm-rtPs_G_35GCYUAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 06:30:08
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 154.213.163.182 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 154.213.163.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 01:29:53.607557 2025] [security2:error] [pid 31356:tid 31356] [client 154.213.163.182:14071] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.maidsinmalta.com"] [uri "/.svn/wc.db"] [unique_id "aSP7YSdFhoGk_wOvNx35YQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 04:10:36
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 154.213.163.182 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 154.213.163.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:10:29.690977 2025] [security2:error] [pid 9821:tid 9821] [client 154.213.163.182:21925] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.manosentuayuda.org"] [uri "/.svn/wc.db"] [unique_id "aSPatdAtAGWxMdbqavipZAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-10 13:49:28
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 154.213.163.182 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 154.213.163.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 10 09:49:24.454846 2025] [security2:error] [pid 27043:tid 27043] [client 154.213.163.182:31323] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||aboutio.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aboutio.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aOkO5BXRHuKebcrkLIg3eQAAAAA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-10-08 08:09:56
(8 months ago)
[redacted] 154.213.163.182 - - [08/Oct/2025:10:09:46 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" ...
show more
[redacted] 154.213.163.182 - - [08/Oct/2025:10:09:46 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (iPad; CPU OS 12_1 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) GSA/62.1.220348572 Mobile/16B92 Safari/604.1"
[redacted] 154.213.163.182 - - [08/Oct/2025:10:09:49 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/601.4.4 (KHTML, like Gecko) Version/9.0.3 Safari/601.4.4"
[redacted] 154.213.163.182 - - [08/Oct/2025:10:09:50 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (iPad; CPU OS 11_0_2 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A421 Safari/604.1"
[redacted] 154.213.163.182 - - [08/Oct/2025:10:09:50 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2)"
[redacted] 154.213.163.182 - - [08/Oct/2025:10:09:51 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64)
...
show less
Hacking
Web App Attack
🇳🇱
applemooz
2025-10-07 17:18:43
(8 months ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
🇺🇸
WeekendWeb
2025-10-04 09:47:57
(8 months ago)
Wordpress Vunerability attack
Web App Attack
2025-09-30 15:51:39
(8 months ago)
[redacted] 154.213.163.182 - - [30/Sep/2025:17:51:20 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" ...
show more
[redacted] 154.213.163.182 - - [30/Sep/2025:17:51:20 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.0 Mobile/14G60 Safari/602.1"
[redacted] 154.213.163.182 - - [30/Sep/2025:17:51:22 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36"
[redacted] 154.213.163.182 - - [30/Sep/2025:17:51:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (Linux; Android 4.4.2; es-us; Avvio_793 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Mobile Safari/537.36"
[redacted] 154.213.163.182 - - [30/Sep/2025:17:51:25 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)"
[redacted] 154.213.163.182 - - [30/Sep/2025:17:51:26 +0200]
...
show less
Hacking
Web App Attack
2025-09-29 02:07:36
(8 months ago)
WordPress Brute Force
Brute-Force
🇩🇪
applemooz
2025-09-27 00:04:40
(9 months ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack