🇺🇸
TPI-Abuse
2025-10-04 04:50:40
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 156.253.169.32 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 156.253.169.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 04 00:50:32.943064 2025] [security2:error] [pid 32424:tid 32424] [client 156.253.169.32:16715] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||frelsburg.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "frelsburg.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aOCnmCdp4BpfrwgK7E863QAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-02 19:58:25
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 156.253.169.32 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 156.253.169.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 02 15:58:18.137319 2025] [security2:error] [pid 11967:tid 11967] [client 156.253.169.32:33343] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||g-peopleland.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "g-peopleland.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aN7ZWlNTL96jM7R9UZuWawAAAAQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
applemooz
2025-09-27 00:35:03
(8 months ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
🇫🇮
YF
2025-09-26 17:00:57
(8 months ago)
xmlrpc.php (Potential DDoS or brute force)
Brute-Force
Web App Attack
🇦🇺
AWW-Admin
2025-09-24 23:36:01
(8 months ago)
(wordpress) Failed wordpress login from 156.253.169.32 (GB/United Kingdom/-)
Brute-Force
🇺🇸
TPI-Abuse
2025-09-09 22:20:11
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 156.253.169.32 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 156.253.169.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 09 18:20:04.851879 2025] [security2:error] [pid 15051:tid 15051] [client 156.253.169.32:35365] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.calgaryhottubsale.wholesalelivelobsters.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.calgaryhottubsale.wholesalelivelobsters.com"] [uri "/s3cmd.ini"] [unique_id "aMCoFPNa_o0x0Myu_GsuQwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
bsoft.de
2025-09-08 02:18:52
(8 months ago)
156.253.169.32 - - [08/Sep/2025:03:07:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 ...
show more
156.253.169.32 - - [08/Sep/2025:03:07:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (Linux; Android 7.0; BLL-L22 Build/HUAWEIBLL-L22) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.91 Mobile Safari/537.36"
156.253.169.32 - - [08/Sep/2025:03:36:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.1.4322)"
156.253.169.32 - - [08/Sep/2025:04:18:50 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6"
show less
Web App Attack
🇩🇪
f2_IT
2025-09-01 21:35:53
(9 months ago)
SSLVPN Login attempt (blocked type h) from 156.253.169.32
Brute-Force
🇩🇪
Ba-Yu
2025-08-25 05:55:06
(9 months ago)
WP-xmlrpc exploit
Web Spam
Blog Spam
Hacking
Exploited Host
Web App Attack
🇩🇪
Hary74656
2025-08-24 14:30:00
(9 months ago)
[Sun Aug 24 16:29:57.653539 2025] [authz_core:error] [pid 429155:tid 429216] [client 156.253.169.32: ...
show more
[Sun Aug 24 16:29:57.653539 2025] [authz_core:error] [pid 429155:tid 429216] [client 156.253.169.32:39465] AH01630: client denied by server configuration: /home/harald/www/aschi.at/xmlrpc.php
...
show less
Bad Web Bot
2024-12-30 06:12:53
(1 year ago)
Attempted brute force login to web vpn 10 time(s); last attempt for 2024.12.30 is noted in report ti ...
show more
Attempted brute force login to web vpn 10 time(s); last attempt for 2024.12.30 is noted in report timestamp
show less
Hacking
Brute-Force