🇩🇪
Klompenzijncool
2026-11-13 02:08:28
UTC ·
(1 day ago)
Web scanning/probing blocked by Fail2Ban.
Port Scan
Bad Web Bot
🇩🇪
LRob
2026-11-12 08:30:43
UTC ·
(1 day ago)
WordPress attack-tool calls | method: POST | path: /xmlrpc.php | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-12 01:43:52
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 161.0.156.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 20:43:46.104402 2026] [security2:error] [pid 23546:tid 23657] [client 161.0.156.136:39642] M ...
show more
(mod_security) mod_security (id:225170) triggered by 161.0.156.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 20:43:46.104402 2026] [security2:error] [pid 23546:tid 23657] [client 161.0.156.136:39642] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||quantumgaze.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "quantumgaze.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avUZ0rJaH-4YyKwdDbQqtAAAANM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 01:19:37
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 161.0.156.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 20:19:30.379188 2026] [security2:error] [pid 30679:tid 30679] [client 161.0.156.136:39272] M ...
show more
(mod_security) mod_security (id:225170) triggered by 161.0.156.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 20:19:30.379188 2026] [security2:error] [pid 30679:tid 30679] [client 161.0.156.136:39272] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cityoffoley.gov|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cityoffoley.gov"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avUUIiTcwZGWClvT3OhY-AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
lostswordfish.com
2026-11-11 22:02:04
UTC ·
(2 days ago)
Wordfence waf block on parsol
Web App Attack
🇫🇮
stinpriza
2026-11-11 15:03:37
UTC ·
(2 days ago)
Web App Attack
Web App Attack
2026-11-10 02:44:45
UTC ·
(4 days ago)
wordpress authentication brute force
Brute-Force
Web App Attack
🇩🇪
nyuuzyou
2026-11-05 10:43:10
UTC ·
(1 week ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-11-05T10:43:10Z.
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-24 05:31:59
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 161.0.156.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 01:31:50.222143 2026] [security2:error] [pid 5173:tid 5173] [client 161.0.156.136:44502] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 161.0.156.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 01:31:50.222143 2026] [security2:error] [pid 5173:tid 5173] [client 161.0.156.136:44502] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||geckoturner.chezlubacov.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "geckoturner.chezlubacov.org"] [uri "/wp-json/wp/v2/users"] [unique_id "atxCxsHuWtYFbboNSy7kvAAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-10-23 22:36:00
UTC ·
(3 weeks ago)
Try to access /xmlrpc.php
Web App Attack
2025-11-15 03:29:36
UTC ·
(11 months ago)
scanning http requests from known botnet
Web App Attack
🇺🇸
TPI-Abuse
2025-09-29 22:27:47
UTC ·
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 161.0.156.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 29 18:27:42.717420 2025] [security2:error] [pid 14892:tid 14892] [client 161.0.156.136:58934] M ...
show more
(mod_security) mod_security (id:210730) triggered by 161.0.156.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 29 18:27:42.717420 2025] [security2:error] [pid 14892:tid 14892] [client 161.0.156.136:58934] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.savoiapower.com|F|2"] [data ".8k.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.savoiapower.com"] [uri "/ biodiesel.8k.com"] [unique_id "aNsH3oMDy_wMK_Pk_-W7sAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
