🇺🇸
mnsf
2026-11-07 06:05:30
UTC ·
(48 minutes ago)
Login Too Frequent (40)
Request Overload (210)
Brute-Force
Web App Attack
2026-11-07 04:19:02
UTC ·
(2 hours ago)
Bot / scanning and/or hacking attempts: GET /wp-login.php?redirect_to=http%3A%2F%2Fan3.nl%2Fwp-admin%2F, POST /wp-login.php HTTP/1.1, GET /wp-admin/index.php HTTP/1.1
Hacking
Web App Attack
🇳🇱
Site.eu
2026-11-07 02:56:59
UTC ·
(3 hours ago)
WordPress login brute force (wp-login/xmlrpc login attempts)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 02:32:13
UTC ·
(4 hours ago)
(mod_security) mod_security (id:225170) triggered by 165.245.182.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 21:32:08.666606 2026] [security2:error] [pid 10134:tid 10134] [client 165.245.182.123:5437 ...
show more
(mod_security) mod_security (id:225170) triggered by 165.245.182.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 21:32:08.666606 2026] [security2:error] [pid 10134:tid 10134] [client 165.245.182.123:54374] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||creationorevolution.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "creationorevolution.net"] [uri "/wp-json/wp/v2/users"] [unique_id "au6NqBBcyl9PUGa3yp349gAAAAo"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 02:04:42
UTC ·
(4 hours ago)
(mod_security) mod_security (id:225170) triggered by 165.245.182.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 21:04:34.225121 2026] [security2:error] [pid 29101:tid 29101] [client 165.245.182.123:6010 ...
show more
(mod_security) mod_security (id:225170) triggered by 165.245.182.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 21:04:34.225121 2026] [security2:error] [pid 29101:tid 29101] [client 165.245.182.123:60108] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||closedfortheseason.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "closedfortheseason.com"] [uri "/wordpress/wp-json/wp/v2/users"] [unique_id "au6HMvrXySv7ubANu0LEjwAAAAQ"], referer: https://www.facebook.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 23:23:05
UTC ·
(7 hours ago)
(mod_security) mod_security (id:225170) triggered by 165.245.182.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:23:00.507386 2026] [security2:error] [pid 16088:tid 16088] [client 165.245.182.123:6164 ...
show more
(mod_security) mod_security (id:225170) triggered by 165.245.182.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:23:00.507386 2026] [security2:error] [pid 16088:tid 16088] [client 165.245.182.123:61649] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||barecreationsaz.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "barecreationsaz.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au5hVI7GkafozoOwz6z_HAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 22:56:46
UTC ·
(7 hours ago)
(mod_security) mod_security (id:225170) triggered by 165.245.182.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 17:56:39.690283 2026] [security2:error] [pid 9199:tid 9199] [client 165.245.182.123:58902] ...
show more
(mod_security) mod_security (id:225170) triggered by 165.245.182.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 17:56:39.690283 2026] [security2:error] [pid 9199:tid 9199] [client 165.245.182.123:58902] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||buenasfrecuencias.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "buenasfrecuencias.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au5bJxhjRk7WeTXQrDaobAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 15:58:12
UTC ·
(14 hours ago)
(mod_security) mod_security (id:225170) triggered by 165.245.182.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 10:58:09.174787 2026] [security2:error] [pid 3974:tid 3974] [client 165.245.182.123:51134] ...
show more
(mod_security) mod_security (id:225170) triggered by 165.245.182.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 10:58:09.174787 2026] [security2:error] [pid 3974:tid 3974] [client 165.245.182.123:51134] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||atcreport.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "atcreport.com"] [uri "/wp/wp-json/wp/v2/users"] [unique_id "au35EQrbrLNUnxg2N7rVegAAAA4"], referer: https://www.google.com/search?q=wordpress
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
2000cn.com.au
2026-11-06 13:42:04
UTC ·
(17 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bf-wordpress_bf
Web App Attack
Brute-Force
🇲🇾
Rizzy
2026-11-05 21:49:16
UTC ·
(1 day ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 07:31:06
UTC ·
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 165.245.182.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 02:30:58.247832 2026] [security2:error] [pid 21324:tid 21324] [client 165.245.182.123:6196 ...
show more
(mod_security) mod_security (id:225170) triggered by 165.245.182.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 02:30:58.247832 2026] [security2:error] [pid 21324:tid 21324] [client 165.245.182.123:61967] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||capriexpress.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "capriexpress.com"] [uri "/wp-json/wp/v2/users"] [unique_id "auwwsrVP5FN16ZQ7Z2kRQgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-11-05 07:25:03
UTC ·
(1 day ago)
WordPress login brute force (wp-login/xmlrpc login attempts)
Brute-Force
Web App Attack
🇺🇸
gu-alvareza
2026-11-05 05:06:56
UTC ·
(2 days ago)
WordPress.REST.API.Username.Enumeration.Information.Disclosure
Web App Attack
🇸🇬
pusathosting.com
2026-11-05 02:57:03
UTC ·
(2 days ago)
24ds22 bruteforce
Brute-Force
Web App Attack
🇹🇼
tye
2026-05-28 02:01:20
UTC ·
(5 months ago)
Wazuh Alert Evidence: May 28 02:01:17 pico-gw1 named[3393073]: client @0xffff88010d48 165.245.182.123#39833 (example.com): query (cache) 'example.com/A/IN' denied (allow-query-cache did not match)
Hacking
