🇺🇸
TPI-Abuse
2026-09-19 14:07:55
(8 minutes ago)
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 10:07:52.043644 2026] [security2:error] [pid 15204:tid 15204] [client 161.97.166.241:57490] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||velocitymech.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "velocitymech.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aq6XOH6B-APy95W8M88QVQAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-19 13:32:00
(44 minutes ago)
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 09:31:53.619636 2026] [security2:error] [pid 13391:tid 13391] [client 161.97.166.241:52016] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||tracytappan.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tracytappan.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aq6OyV_qu_eiqum9uySLlgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-19 13:02:47
(1 hour ago)
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 09:02:39.511273 2026] [security2:error] [pid 5910:tid 5995] [client 161.97.166.241:39958] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||koalacogs.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "koalacogs.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aq6H75cSDqjRgzzSctAP9gAAAE4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-19 12:22:15
(1 hour ago)
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 08:22:09.753392 2026] [security2:error] [pid 1407615:tid 1407615] [client 161.97.166.241:38202] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nuewines.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nuewines.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aq5-cRq9riBeSugRUXj_zgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-09-19 11:30:43
(2 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-09-19 10:32:20
(3 hours ago)
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 06:32:13.890410 2026] [security2:error] [pid 14467:tid 14467] [client 161.97.166.241:50270] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mosheimlib.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mosheimlib.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aq5krSbrZI-YsGhPRUd7SgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-19 10:15:52
(4 hours ago)
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 06:15:46.900520 2026] [security2:error] [pid 10272:tid 10272] [client 161.97.166.241:39950] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.xhumanlikerobots.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.xhumanlikerobots.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aq5g0unZjjQEiW5oHhfZNQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 01:46:04
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 21:45:56.025562 2026] [security2:error] [pid 13558:tid 13558] [client 161.97.166.241:40944] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||sizefinder.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sizefinder.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqyX1OWhXfBOmyw2buR7tQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
rh24
2026-09-17 23:45:17
(1 day ago)
(wordpress-user-enum) Failed wordpress-user-enum trigger from 161.97.166.241 (FR/France/server.webho ...
show more
(wordpress-user-enum) Failed wordpress-user-enum trigger from 161.97.166.241 (FR/France/server.webhostbase.com): (CF_ENABLE)
show less
Brute-Force
🇩🇪
FeG Deutschland
2026-09-17 17:54:54
(1 day ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 14:27:52
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 10:27:48.286170 2026] [security2:error] [pid 29802:tid 29802] [client 161.97.166.241:33068] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||margroberts.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "margroberts.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqv45H5o6IwUKhXP-irxegAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 12:20:23
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 161.97.166.241 (server.webhostbase.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 08:20:16.930652 2026] [security2:error] [pid 12149:tid 12149] [client 161.97.166.241:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||upskirtcrazy.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "upskirtcrazy.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqvbAIRbJWvF5onlKbNOLAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
BlueWire Hosting
2026-09-17 09:43:37
(2 days ago)
Probing websites for vulnerabilities
Web App Attack
🇫🇷
Omar Martínez
2026-09-17 07:27:24
(2 days ago)
161.97.166.241 - - [17/Sep/2026:01:27:22 -0600] "GET /wp-json/wp/v2/users HTTP/1.1" 200 7442 "-" "Mo ...
show more
161.97.166.241 - - [17/Sep/2026:01:27:22 -0600] "GET /wp-json/wp/v2/users HTTP/1.1" 200 7442 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0"
...
show less
Phishing
Email Spam
Blog Spam
🇩🇪
maxpower
2026-09-17 06:49:36
(2 days ago)
(wp_fingerprint) REGOLA 6 - WP Exploit Attempt xmlrpc 161.97.166.241 (FR/France/server.webhostbase.c ...
show more
(wp_fingerprint) REGOLA 6 - WP Exploit Attempt xmlrpc 161.97.166.241 (FR/France/server.webhostbase.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 161.97.166.241 - - [17/Sep/2026:08:49:34 +0200] "GET /wp-json/wp/v2/users HTTP/1.1" 200 12145 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0" "-" host=gabriellaciammaichella.com
show less
Port Scan