🇺🇸
WeekendWeb
2025-10-06 20:22:22
(8 months ago)
Wordpress Vunerability attack
Web App Attack
🇺🇸
TPI-Abuse
2025-10-04 23:49:55
(8 months ago)
(mod_security) mod_security (id:210831) triggered by 156.228.190.74 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 156.228.190.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 04 19:49:50.507223 2025] [security2:error] [pid 27462:tid 27468] [client 156.228.190.74:56351] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||plumeraproductions.com|F|4"] [data "compatible ; MSIE"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "plumeraproductions.com"] [uri "/xmlrpc.php"] [unique_id "aOGyngsxSIDvBSNa2_f_BwAAAMQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
applemooz
2025-10-04 22:17:24
(8 months ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
🇫🇮
YF
2025-09-27 00:01:34
(8 months ago)
xmlrpc.php (Potential DDoS or brute force)
Brute-Force
Web App Attack
🇩🇪
Marc
2025-09-12 02:53:28
(9 months ago)
Brute-Force
🇺🇸
TPI-Abuse
2025-09-10 07:23:08
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 156.228.190.74 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 156.228.190.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 10 03:23:00.847070 2025] [security2:error] [pid 17697:tid 17697] [client 156.228.190.74:23731] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.cw-enterprises.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.cw-enterprises.com"] [uri "/s3cmd.ini"] [unique_id "aMEnVJnl6t1uXkrMvD0AGgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-10 02:56:12
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 156.228.190.74 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 156.228.190.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 09 22:56:05.415617 2025] [security2:error] [pid 992:tid 992] [client 156.228.190.74:55567] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.casadelsolmexico.net|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.casadelsolmexico.net"] [uri "/s3cmd.ini"] [unique_id "aMDoxQyOiCQ5Euo0MFRD4gAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-09 18:03:25
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 156.228.190.74 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 156.228.190.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 09 14:03:22.725238 2025] [security2:error] [pid 4429:tid 4452] [client 156.228.190.74:38359] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.coloradospringsmardigras.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.coloradospringsmardigras.com"] [uri "/s3cmd.ini"] [unique_id "aMBr6rzWWek6aGyTzMtglAAAAVQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
SilverZippo
2025-09-09 17:16:13
(9 months ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2025-09-09 12:15:29
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 156.228.190.74 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 156.228.190.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 09 08:15:24.092184 2025] [security2:error] [pid 30590:tid 30590] [client 156.228.190.74:37019] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.blingmeadvertising.callalbany.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.blingmeadvertising.callalbany.com"] [uri "/s3cmd.ini"] [unique_id "aMAaXFptZkSnMdA46v-UoAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
weblite
2025-09-03 04:06:16
(9 months ago)
WP_XMLRPC_ABUSE
Brute-Force
Web App Attack
🇩🇪
Ba-Yu
2025-08-23 18:44:33
(9 months ago)
WP-xmlrpc exploit
Web Spam
Blog Spam
Hacking
Exploited Host
Web App Attack
🇨🇦
wil.com
2025-08-06 04:13:15
(10 months ago)
GlobalProtect login attempts with user inquiry.
VPN IP
Brute-Force
2025-08-05 00:38:45
(10 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇩🇪
nyuuzyou
2024-11-17 10:10:16
(1 year ago)
Intensive scraping: /web?s=media%20buying%20vs%20media%20planning&country=is-is&scraper=wiby. User-A ...
show more
Intensive scraping: /web?s=media%20buying%20vs%20media%20planning&country=is-is&scraper=wiby. User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/89.0.4447.51.
show less
Bad Web Bot