2025-09-28 03:08:49
(9 months ago)
2025-09-28T05:08:49.511655+02:00 zanati wp(www.sahpa.co.za)[812860]: Blocked authentication attempt ...
show more
2025-09-28T05:08:49.511655+02:00 zanati wp(www.sahpa.co.za)[812860]: Blocked authentication attempt for [email protected] from 156.253.179.132
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-09-25 03:42:31
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 156.253.179.132 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.253.179.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 24 23:42:25.518776 2025] [security2:error] [pid 29291:tid 29291] [client 156.253.179.132:36097] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nordicbuilders.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nordicbuilders.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aNS6IW_GXbpbdq3eyUHwyQAAAGE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-09-13 15:00:07
(9 months ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇮🇹
Rosh
2025-09-07 17:09:42
(10 months ago)
[09/07/25 19:09:41] SSH: illegal login attempts
Brute-Force
SSH
🇧🇷
hostseries
2025-09-04 23:20:19
(10 months ago)
Trigger: LF_DISTATTACK
Brute-Force
🇩🇪
london2038.com
2025-08-25 00:06:27
(10 months ago)
Connection atttempts against closed TCP ports
Aug 25 02:06:19 BLOCK SRC=156.253.179.132 LEN=60 TOS=0 ...
show more
Connection atttempts against closed TCP ports
Aug 25 02:06:19 BLOCK SRC=156.253.179.132 LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=12321 DF PROTO=TCP SPT=31153 DPT=2087 WINDOW=64240 RES=0x00 SYN
Aug 25 02:06:20 BLOCK SRC=156.253.179.132 LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=12322 DF PROTO=TCP SPT=31153 DPT=2087 WINDOW=64240 RES=0x00 SYN
Aug 25 02:06:21 BLOCK SRC=156.253.179.132 LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=12323 DF PROTO=TCP SPT=31153 DPT=2087 WINDOW=64240 RES=0x00 SYN
show less
Port Scan
2025-07-23 15:27:53
(11 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇬🇧
Swiptly
2025-05-10 06:32:34
(1 year ago)
WordPress xmlrpc spam or enumeration
...
Web Spam
Bad Web Bot
Web App Attack
🇨🇭
backslash
2025-04-29 14:20:09
(1 year ago)
block ruleset 3D3AFA921A373ECE19B6BA285C2D722163304638
Bad Web Bot
🇺🇸
TPI-Abuse
2025-04-18 23:58:34
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 156.253.179.132 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.253.179.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 18 19:58:31.501782 2025] [security2:error] [pid 4745:tid 4745] [client 156.253.179.132:15083] [client 156.253.179.132] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rohn.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rohn.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aALnJ2cEIwaBv1Tj02_sJAAAAAI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-04-18 13:48:02
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
nationaleventpros.com
2025-04-11 09:49:46
(1 year ago)
WordPress login attempt
Brute-Force
2025-04-09 02:04:50
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-04-08 21:20:31
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 156.253.179.132 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.253.179.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 08 17:20:24.161211 2025] [security2:error] [pid 26797:tid 26797] [client 156.253.179.132:55507] [client 156.253.179.132] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||listerman.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "listerman.org"] [uri "/wp-json/wp/v2/users"] [unique_id "Z_WTGFUKvdZlHuRARChorgAAABE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-04-08 14:53:56
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 156.253.179.132 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.253.179.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 08 10:53:50.199438 2025] [security2:error] [pid 11109:tid 11109] [client 156.253.179.132:13561] [client 156.253.179.132] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||chatsupply.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "chatsupply.us"] [uri "/wp-json/wp/v2/users"] [unique_id "Z_U4fsweWLnSYoYbv2My5gAAAAs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack