🇺🇸
TPI-Abuse
2025-10-01 03:05:09
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 156.253.172.113 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.253.172.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 23:05:04.729654 2025] [security2:error] [pid 1271499:tid 1271499] [client 156.253.172.113:48607] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||darrenj.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "darrenj.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aNyaYCPCW2YXlW9Kxo-SnwAAAAQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-30 23:42:16
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 156.253.172.113 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.253.172.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 19:42:09.207992 2025] [security2:error] [pid 11065:tid 11084] [client 156.253.172.113:59261] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||vavryn.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "vavryn.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aNxq0X4AoYTqYFNnDazm8wAAABE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-28 00:43:42
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 156.253.172.113 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.253.172.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 27 20:43:34.310144 2025] [security2:error] [pid 1046:tid 1046] [client 156.253.172.113:31465] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ceezees.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ceezees.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aK-mNkrJUQb0j8-UBCPVYQAAAAQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-07-26 18:18:21
(10 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇦🇺
oncord
2025-04-07 08:54:41
(1 year ago)
Form spam
Web Spam
🇪🇸
el-brujo
2025-04-07 05:11:10
(1 year ago)
07/Apr/2025:07:11:09.839387 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
07/Apr/2025:07:11:09.839387 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 156.253.172.113] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\\\\\{|\\\\\\\\||\\\\\\\\|\\\\\\\\||&|&&|\\\\\\\\n|\\\\\\\\r|`)\\\\\\\\s*[\\\\\\\\(,@\\\\\\\\'\\\\"\\\\\\\\s]*(?:[\\\\\\\\w'\\\\"\\\\\\\\./]+/|[\\\\\\\\\\\\\\\\'\\\\"\\\\\\\\^]*\\\\\\\\w[\\\\\\\\\\\\\\\\'\\\\"\\\\\\\\^]*:.*\\\\\\\\\\\\\\\\|[\\\\\\\\^\\\\\\\\.\\\\\\\\w '\\\\"/\\\\\\\\\\\\\\\\]*\\\\\\\\\\\\\\\\)?[\\\\"\\\\\\\\^]*(?:s[\\\\"\\\\\\\\^]*(?:y[\\\\"\\\\\\\\^]*s[\\\\"\\\\\\\\^]*(?:t[\\\\"\\\\\\\\^]*e[\\\\"\\\\\\\\^]*m[\\\\"\\\\\\\\^]*(?:p[\\\\"\\\\\\\\^]*r[\\\\"\\\\\\\\^]*o[\\\\"\\\\\\\\^]*p[\\\\"\\\\\\\\^]*e ..." at ARGS:your-subject. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "295"] [id "932115"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: \\\\x0d\\\\x0a\\\\x0d\\\\x0aStart with a free trial of 4,000 visitors to realize the b
...
show less
Hacking
Web App Attack
🇦🇺
oncord
2025-04-03 20:25:15
(1 year ago)
Form spam
Web Spam
🇦🇺
oncord
2025-04-01 18:42:27
(1 year ago)
Form spam
Web Spam
🇬🇧
oncord
2025-03-29 16:01:26
(1 year ago)
Form spam
Web Spam
🇦🇺
oncord
2025-03-27 13:19:27
(1 year ago)
Form spam
Web Spam
🇺🇸
oncord
2025-03-23 21:57:43
(1 year ago)
Form spam
Web Spam
🇦🇺
oncord
2025-03-22 05:35:06
(1 year ago)
Form spam
Web Spam
🇦🇺
oncord
2025-03-21 04:35:13
(1 year ago)
Form spam
Web Spam
🇦🇺
oncord
2025-03-19 16:39:10
(1 year ago)
Form spam
Web Spam
🇦🇺
oncord
2025-03-18 02:09:54
(1 year ago)
Form spam
Web Spam