🇫🇷
masterguru
2026-04-21 13:07:22
(1 month ago)
Too much 404 requests in 1 minute. Operator GE matched 10 at IP:block_script. (46020-201)
Hacking
🇺🇸
myagent.site
2026-04-05 21:57:22
(2 months ago)
Blocking for trying to access an exploit file: /xmlrpc.php
Hacking
2026-04-01 05:26:20
(2 months ago)
...
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 12:41:49
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 169.150.218.66 (unn-169-150-218-66.datapacket.c ...
show more
(mod_security) mod_security (id:225170) triggered by 169.150.218.66 (unn-169-150-218-66.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 08:41:43.780596 2026] [security2:error] [pid 7254:tid 7254] [client 169.150.218.66:54840] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||415test.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "415test.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acvBB_umU92iPXtN3zEWkAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Sylvyon
2026-03-18 00:19:52
(2 months ago)
Triggered Cloudflare WAF (firewallCustom) from NL.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (P ...
show more
Triggered Cloudflare WAF (firewallCustom) from NL.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (POST) | Endpoint: /xmlrpc.php | UA: Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/76.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
LRob.fr
2026-03-17 23:30:19
(2 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
2026-03-14 13:09:58
(3 months ago)
169.150.218.66 - - [14/Mar/2026:13:09:57 +0000] "POST /xmlrpc.php HTTP/1.1" 404 17323 "-" "Mozilla/5 ...
show more
169.150.218.66 - - [14/Mar/2026:13:09:57 +0000] "POST /xmlrpc.php HTTP/1.1" 404 17323 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/11.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
Marc
2026-03-04 19:06:08
(3 months ago)
Brute-Force
Web App Attack
🇺🇸
myagent.site
2026-03-04 19:01:49
(3 months ago)
Blocking for trying to access an exploit file: /xmlrpc.php
Hacking
🇩🇪
Bedios GmbH
2026-03-03 08:04:47
(3 months ago)
Wordpress hacking attempt
Web App Attack
🇺🇸
TPI-Abuse
2026-02-27 11:05:55
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 169.150.218.66 (unn-169-150-218-66.datapacket.c ...
show more
(mod_security) mod_security (id:225170) triggered by 169.150.218.66 (unn-169-150-218-66.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 27 06:05:51.188581 2026] [security2:error] [pid 6200:tid 6200] [client 169.150.218.66:60256] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thepinman.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thepinman.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aaF6j-y5j82WzBiywFpWwAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-02-07 17:00:09
(1 year ago)
BruteForce IMAP/POP3
Brute-Force
🇺🇸
TPI-Abuse
2024-10-01 16:04:33
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 169.150.218.66 (unn-169-150-218-66.datapacket.c ...
show more
(mod_security) mod_security (id:210492) triggered by 169.150.218.66 (unn-169-150-218-66.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 01 12:04:25.827353 2024] [security2:error] [pid 26236:tid 26236] [client 169.150.218.66:25439] [client 169.150.218.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.rockwranglers.org"] [uri "/.env"] [unique_id "ZvwdiTrmsCvyPYm6JIbmRAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-10-01 12:53:58
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 169.150.218.66 (unn-169-150-218-66.datapacket.c ...
show more
(mod_security) mod_security (id:210492) triggered by 169.150.218.66 (unn-169-150-218-66.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 01 08:53:55.290679 2024] [security2:error] [pid 23129:tid 23129] [client 169.150.218.66:18503] [client 169.150.218.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.worldofeconomics.com"] [uri "/.env"] [unique_id "Zvvw47G2sTLDMaHsxkJAewAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-09-29 11:30:18
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH