🇧🇪
taivas.nl
2026-06-04 04:32:26
(1 day ago)
Many_bad_calls
Web App Attack
🇩🇪
LRob.fr
2026-06-04 03:30:06
(1 day ago)
Repeated 404 errors, blocked by Fail2ban in custom-404 jail
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-04 02:48:55
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 167.99.75.227 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 167.99.75.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 22:48:50.405371 2026] [security2:error] [pid 12779:tid 12779] [client 167.99.75.227:53613] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.solucionesmercadeodigital.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.solucionesmercadeodigital.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aiDnkqP7Dc0jFfggW6zHPAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
lavnet.net
2026-06-04 02:47:06
(1 day ago)
167.99.75.227 - - [04/Jun/2026:02:47:04 +0000] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404 2083 ...
show more
167.99.75.227 - - [04/Jun/2026:02:47:04 +0000] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404 2083 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
167.99.75.227 - - [04/Jun/2026:02:47:04 +0000] "GET /xmlrpc.php?rsd HTTP/1.1" 403 2086 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
167.99.75.227 - - [04/Jun/2026:02:47:05 +0000] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 2083 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
167.99.75.227 - - [04/Jun/2026:02:47:05 +0000] "GET /web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 2083 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
167.99.75.227 - - [04/Jun/2026:02:47:05 +0000] "GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 2083 "-" "M
...
show less
Brute-Force
🇬🇧
AvonleaConsulting
2026-06-04 01:20:31
(1 day ago)
Scanning unused Default website or suspicious access to valid sites from IP marked as abusive
Bad Web Bot
Web App Attack
🇮🇱
Dolphi
2026-06-04 01:20:03
(1 day ago)
POST //xmlrpc.php
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-04 01:13:04
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 167.99.75.227 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 167.99.75.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 21:13:00.071811 2026] [security2:error] [pid 28712:tid 28712] [client 167.99.75.227:57468] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||snowrideadventures.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "snowrideadventures.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aiDRHKklfmwLY6stuF1rXQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
strefapi_com
2026-06-04 00:35:22
(1 day ago)
Brute-force, web
...
Hacking
Brute-Force
Web App Attack
2026-06-03 23:49:03
(1 day ago)
Bot / scanning and/or hacking attempts: GET //?author=1 HTTP/1.1, POST //xmlrpc.php HTTP/1.1, GET // ...
show more
Bot / scanning and/or hacking attempts: GET //?author=1 HTTP/1.1, POST //xmlrpc.php HTTP/1.1, GET //?author=2 HTTP/1.1, GET //wp-includes/wlwmanifest.xml HTTP/1.1, GET //wp-json/wp/v2/users/ HTTP/1.1, GET //xmlrpc.php?rsd HTTP/1.1, GET / HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-03 23:18:27
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 167.99.75.227 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 167.99.75.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 19:18:20.273464 2026] [security2:error] [pid 31826:tid 31826] [client 167.99.75.227:58535] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.smilingorc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.smilingorc.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aiC2PHslZCDZle2Pd7TN9wAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
mgarofano80
2026-06-03 23:13:44
(1 day ago)
Brute-Force
Web App Attack
🇫🇷
applemooz
2026-06-03 22:58:39
(1 day ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
🇮🇩
zam
2026-06-03 22:36:39
(1 day ago)
167.99.75.227 - - [03/Jun/2026:22:36:37 +0000] "POST //xmlrpc.php HTTP/1.1" 403 239
Web App Attack
🇺🇸
jcbriar
2026-06-03 22:27:35
(1 day ago)
Searching for vulnerable scripts
Hacking
Web App Attack
🇺🇸
slay3r9903
2026-06-03 21:57:44
(1 day ago)
IP address blocked by Cloudflare security rules due to suspicious activity and security violations.
Hacking
Bad Web Bot