🇺🇸
TPI-Abuse
2026-08-31 11:18:05
(48 minutes ago)
(mod_security) mod_security (id:225170) triggered by 161.35.201.109 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 161.35.201.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 07:18:01.204735 2026] [security2:error] [pid 4148:tid 4148] [client 161.35.201.109:57140] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||pattenden.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "pattenden.com"] [uri "/wp-json/wp/v2/users"] [unique_id "apVi6VT82S2IasRapFB-mAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-31 10:58:43
(1 hour ago)
(mod_security) mod_security (id:225170) triggered by 161.35.201.109 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 161.35.201.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 06:58:40.299186 2026] [security2:error] [pid 1131:tid 1131] [client 161.35.201.109:59856] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||dwightbrown.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dwightbrown.com"] [uri "/wp-json/wp/v2/users"] [unique_id "apVeYNpncpf1uhEVumC8_AAAAAg"], referer: http://dwightbrown.com/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-31 08:54:30
(3 hours ago)
(mod_security) mod_security (id:225170) triggered by 161.35.201.109 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 161.35.201.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 04:54:25.369166 2026] [security2:error] [pid 16201:tid 16201] [client 161.35.201.109:46118] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.soundtrax.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.soundtrax.net"] [uri "/wp-json/wp/v2/users"] [unique_id "apVBQT8FBy26KPNczUAdqQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
neckaralb-admin.de
2026-08-31 05:47:27
(6 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
2026-08-31 03:08:02
(8 hours ago)
Bot / scanning and/or hacking attempts: GET /wp-login.php HTTP/1.1
Hacking
Web App Attack
🇨🇭
flaus
2026-08-31 02:51:50
(9 hours ago)
$f2bV_matches
Hacking
Bad Web Bot
Web App Attack
🇺🇸
entangled_mongoose
2026-08-31 02:42:39
(9 hours ago)
Probed /wp-login.php.
Web App Attack
🇫🇷
LRob
2026-08-31 02:27:43
(9 hours ago)
Malicious web request: probing for secrets, traversal or a known exploit path | method: GET | path: ...
show more
Malicious web request: probing for secrets, traversal or a known exploit path | method: GET | path: /wp-json/wp/v2/users | 2026-08-31 02:27 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-31 02:15:58
(9 hours ago)
(mod_security) mod_security (id:225170) triggered by 161.35.201.109 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 161.35.201.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 30 22:15:54.770161 2026] [security2:error] [pid 12600:tid 12600] [client 161.35.201.109:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||yggdrasil.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "yggdrasil.org"] [uri "/wp-json/wp/v2/users"] [unique_id "apTj2m4yLrxoUqVuULbIJgAAAAc"], referer: http://yggdrasil.org/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ambor
2026-08-31 02:07:31
(9 hours ago)
Honeypot access: WordPress admin access attempt. Path: /wp-login.php
Brute-Force
Web App Attack
🇨🇭
backslash
2026-08-31 01:51:00
(10 hours ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇩🇪
ghostwarriors
2026-08-31 01:50:06
(10 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇺🇸
xmission.com
2026-08-31 01:44:12
(10 hours ago)
161.35.201.109 - - [30/Aug/2026:19:44:05 -0600] "POST /wp-login.php HTTP/2.0" 200 2651 "https://dooc ...
show more
161.35.201.109 - - [30/Aug/2026:19:44:05 -0600] "POST /wp-login.php HTTP/2.0" 200 2651 "https://dooce.com/wp-login.php?redirect_to=https%3A%2F%2Fdooce.com%2Fwp-admin%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0"
161.35.201.109 - - [30/Aug/2026:19:44:10 -0600] "POST /wp-login.php HTTP/2.0" 200 2649 "https://dooce.com/wp-login.php?redirect_to=https%3A%2F%2Fdooce.com%2Fwp-admin%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0"
161.35.201.109 - - [30/Aug/2026:19:44:11 -0600] "POST /wp-login.php HTTP/2.0" 200 2651 "https://dooce.com/wp-login.php?redirect_to=https%3A%2F%2Fdooce.com%2Fwp-admin%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0"
...
show less
Brute-Force
🇯🇵
Valhalla
2026-08-31 01:39:27
(10 hours ago)
/wp-login.php
Hacking
Web App Attack
🇩🇪
yitzhaq
2026-08-31 01:35:56
(10 hours ago)
161.35.201.109 - - [31/Aug/2026:01:37:23 +0200] "GET /wp-login.php HTTP/1.1" 301 578 "" "Mozilla/5.0 ...
show more
161.35.201.109 - - [31/Aug/2026:01:37:23 +0200] "GET /wp-login.php HTTP/1.1" 301 578 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0"
161.35.201.109 - - [31/Aug/2026:01:37:23 +0200] "GET /wp-login.php HTTP/2.0" 404 341 "http://[site]/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0"
161.35.201.109 - - [31/Aug/2026:03:35:53 +0200] "GET /wp-login.php HTTP/1.1" 301 590 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0"
161.35.201.109 - - [31/Aug/2026:03:35:53 +0200] "GET /wp-login.php HTTP/2.0" 404 341 "http://[site]/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0"
161.35.201.109 - - [31/Aug/2026:02:22:22 +0200] "GET /wp-login.php HTTP/1.1" 301 590 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0"
161.35.201.109 - - [31/Aug/2026:02:22:22 +0200] "GET /wp-login.php HTTP/2.0" 404 341 "http://
show less
Web App Attack
Hacking