🇺🇸
TPI-Abuse
2026-06-23 09:25:16
(21 hours ago)
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 05:25:09.685787 2026] [security2:error] [pid 21267:tid 21267] [client 159.203.76.93:60934] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bonesband.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bonesband.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajpQ9ZbG-VC_ouqC-5z-2wAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
SpaceHost-Server
2026-06-22 22:27:43
(1 day ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 14:54:15
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 10:54:08.968654 2026] [security2:error] [pid 16158:tid 16158] [client 159.203.76.93:52892] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.allotrope.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.allotrope.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajlMkNfLl54FMxu3ol1HyAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 13:00:23
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 09:00:18.749605 2026] [security2:error] [pid 25970:tid 25970] [client 159.203.76.93:45074] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.d-sinema.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.d-sinema.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajkx4mP5V0SibVYqlc0MkgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-22 06:43:13
(2 days ago)
[redacted] 159.203.76.93 - - [22/Jun/2026:08:43:10 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "M ...
show more
[redacted] 159.203.76.93 - - [22/Jun/2026:08:43:10 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:44.0) Gecko/20100101 Firefox/44.0"
[redacted] 159.203.76.93 - - [22/Jun/2026:08:43:10 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0"
[redacted] 159.203.76.93 - - [22/Jun/2026:08:43:10 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0"
[redacted] 159.203.76.93 - - [22/Jun/2026:08:43:10 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0"
[redacted] 159.203.76.93 - - [22/Jun/2026:08:43:10 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0"
[redacted] 159.203.76.93 - - [22/Jun/2026:08:43:10 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 00:39:43
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 20:39:36.700691 2026] [security2:error] [pid 14563:tid 14563] [client 159.203.76.93:35298] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.vzan.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.vzan.org"] [uri "/wp-json/wp/v2/users"] [unique_id "ajiESOBZW-lTR5QsQEiZYAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
SpaceHost-Server
2026-06-21 22:27:15
(2 days ago)
Brute-Force
Web App Attack
🇨🇭
Origon
2026-06-21 15:56:22
(2 days ago)
http-bf-wordpress_bf - IP: 159.203.76.93 - time="2026-06-21T17:56:22+02:00" level=info msg="(555f66 ...
show more
http-bf-wordpress_bf - IP: 159.203.76.93 - time="2026-06-21T17:56:22+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-bf-wordpress_bf by ip 159.203.76.93 (US/14061) : 4h ban on Ip 159.203.76.93" module=db
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-21 11:49:02
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 07:48:56.659635 2026] [security2:error] [pid 31228:tid 31251] [client 159.203.76.93:34484] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.scottspencergfx.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.scottspencergfx.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajfPqLSfhsdYRhkYBs_GAAAAANU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-21 09:07:10
(2 days ago)
Attac
Brute-Force
🇫🇷
SpaceHost-Server
2026-06-20 22:27:09
(3 days ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-20 21:30:17
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 17:30:10.687767 2026] [security2:error] [pid 12248:tid 12248] [client 159.203.76.93:57892] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.abundancecompany.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.abundancecompany.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajcGYnFCqOWtrtpc73nqfgAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
Rexikon
2026-06-20 20:04:21
(3 days ago)
159.203.76.93 - - [20/Jun/2026:22:04:18 +0200] "POST /wp-login.php HTTP/1.1" 200 16380 "-" "Mozilla/ ...
show more
159.203.76.93 - - [20/Jun/2026:22:04:18 +0200] "POST /wp-login.php HTTP/1.1" 200 16380 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0"
159.203.76.93 - - [20/Jun/2026:22:04:19 +0200] "POST /wp-login.php HTTP/1.1" 200 16380 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0"
159.203.76.93 - - [20/Jun/2026:22:04:19 +0200] "POST /wp-login.php HTTP/1.1" 200 16380 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0"
159.203.76.93 - - [20/Jun/2026:22:04:19 +0200] "POST /wp-login.php HTTP/1.1" 200 16380 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:49.0) Gecko/20100101 Firefox/49.0"
159.203.76.93 - - [20/Jun/2026:22:04:19 +0200] "POST /wp-login.php HTTP/1.1" 200 16380 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:53.0) Gecko/20100101 Firefox/53.0"
...
show less
Brute-Force
🇨🇦
Dolphi
2026-06-20 13:30:02
(3 days ago)
Excessive POST /xmlrpc.php requests
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-20 03:13:11
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 159.203.76.93 (centralindsa.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 23:13:09.089202 2026] [security2:error] [pid 29020:tid 29020] [client 159.203.76.93:44324] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.jeffmasonmusic.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.jeffmasonmusic.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajYFRecZUydEG-2gn1uizQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack