2026-10-04 22:00:57
(3 weeks ago)
Network service scanning detected by FortiGate; source quarantined.
Port Scan
🇺🇸
ipblock.com
2026-07-31 13:11:00
(2 months ago)
IPBlock protected site ID [4055-d][s=07].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-31 03:49:04
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 166.1.131.177 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 166.1.131.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 23:48:56.549870 2026] [security2:error] [pid 634760:tid 634760] [client 166.1.131.177:9551] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gulftelecom.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gulftelecom.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amwbKCJdd9OpxXGzcrKRzAAAAAY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-07-30 19:12:00
(2 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-28 16:11:22
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 166.1.131.177 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 166.1.131.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 28 12:11:15.558733 2026] [security2:error] [pid 1248274:tid 1248274] [client 166.1.131.177:9717] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||reyadecostarica.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "reyadecostarica.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amjUo1w7mmMKaTrAvgQKJQAAAAU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
DRI
2026-07-26 08:34:50
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇨🇦
DRI
2026-07-21 09:55:50
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇺🇸
TPI-Abuse
2026-07-15 12:23:13
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 166.1.131.177 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 166.1.131.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 08:23:10.029524 2026] [security2:error] [pid 27075:tid 27093] [client 166.1.131.177:33897] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||kamins.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "kamins.org"] [uri "/wp-json/wp/v2/users"] [unique_id "ald7roKibZHUqq7iLvcsmgAAAAI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-05-21 21:50:58
(5 months ago)
Web password guessing
Brute-Force
🇻🇳
T4k3d0wnprocess_web
2026-05-20 09:37:52
(5 months ago)
[WAF] HONEYPOT | scanner | Path:robots.txt | ISP: Fast Servers (Pty) Ltd | Finland
Web App Attack
🇺🇸
TPI-Abuse
2026-05-18 13:11:01
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 166.1.131.177 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 166.1.131.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 09:10:55.228482 2026] [security2:error] [pid 26263:tid 26263] [client 166.1.131.177:47923] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||seagrovesrealty.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "seagrovesrealty.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agsP3-V7Fg-u3Jfe6kBnbQAAAAY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-04-30 08:08:43
(5 months ago)
Blocked by CSF 13 firewall - Rule: WPLOGIN
US/United States/-
Web App Attack
2024-11-14 12:59:02
(1 year ago)
Brute force attempt to access portal using various usernames
Brute-Force
🇲🇾
syokadmin
2024-07-29 02:10:53
(2 years ago)
(mod_security) mod_security (id:77140834) triggered by 166.1.131.177 (FI/Finland/-): 1 in the last 3 ...
show more
(mod_security) mod_security (id:77140834) triggered by 166.1.131.177 (FI/Finland/-): 1 in the last 3600 secs
show less
Brute-Force
2024-07-16 12:30:07
(2 years ago)
Unauthorized VPN login attempts
Hacking
Brute-Force