|
Anonymous
|
|
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
|
Hacking
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 167.99.72.116 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 167.99.72.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 29 01:29:13.321201 2024] [security2:error] [pid 12305] [client 167.99.72.116:59636] [client 167.99.72.116] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.opmasterpainter.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.opmasterpainter.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "Zla9KaZVVSi337v3iExvMgAAAAk"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
ph
|
|
Bad web bot attempting to run wp-includes on non-WP site
|
Hacking
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 167.99.72.116 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 167.99.72.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 28 23:53:32.269425 2024] [security2:error] [pid 28572] [client 167.99.72.116:60112] [client 167.99.72.116] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.lexispeaks.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.lexispeaks.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZlamvPFUUraFZVoTPzeuiAAAAAc"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 167.99.72.116 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 167.99.72.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 28 23:30:42.575830 2024] [security2:error] [pid 27958] [client 167.99.72.116:50608] [client 167.99.72.116] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.omnisphere360.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.omnisphere360.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZlahYtDBo97y_s58_GGhoAAAAA4"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇸🇬
pusathosting.com
|
|
2ds22 bruteforce
|
Brute-Force
Web App Attack
|
|
|
Anonymous
|
|
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
|
Brute-Force
SSH
|
|
|
Anonymous
|
|
Excessive 404 Traffic Wordpress
|
Web App Attack
|
|
|
🇧🇪
cmbplf
|
|
805 requests to */xmlrpc.php
|
Brute-Force
Bad Web Bot
|
|
|
🇺🇸
mnsf
|
|
Too many Status 50X (21)
|
Brute-Force
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 167.99.72.116 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 167.99.72.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 28 16:54:24.395826 2024] [security2:error] [pid 16013] [client 167.99.72.116:56640] [client 167.99.72.116] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.usaangelinvestors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.usaangelinvestors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZlZEgKLoYM8NCKWMV7sQswAAAAc"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇪🇸
10dencehispahard SL
|
|
Unauthorized login attempts [ wordpress-xmlrpc]
|
Brute-Force
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 167.99.72.116 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 167.99.72.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 28 12:48:34.801514 2024] [security2:error] [pid 4422] [client 167.99.72.116:52594] [client 167.99.72.116] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gatlintire.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gatlintire.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZlYK4soy08-vdidLAwnH6QAAAAE"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|