🇪🇸
pipeline.es
2026-11-15 01:11:47
UTC ·
(11 hours ago)
WordPress login brute-force | URL: https://ceav.info/wp-login.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-15T01:11:14Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\"169.224.96. ...
show more
WordPress login brute-force | URL: https://ceav.info/wp-login.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-15T01:11:14Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\"169.224.96.99\",\"status_code\":503,\"url\":\"https://ceav.info/wp-login.php\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36\",\"wfid\":4753684} | ASN: Earthlink Telecommunications Equipment Trading & Services DM | Country: IQ
show less
Brute-Force
🇲🇹
Malta
2026-11-14 11:58:33
UTC ·
(1 day ago)
169.224.96.99 - - [14/Nov/2026:12:58:33 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36"
Hacking
Web App Attack
🇰🇷
Jaewon
2026-11-13 00:48:05
UTC ·
(2 days ago)
Automated probing for exposed secrets and admin paths (.env, .git, wp-*, *.php). Banned and reported automatically by fail2ban.
Web App Attack
🇩🇪
LRob
2026-11-12 06:36:47
UTC ·
(3 days ago)
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 | 2026-11-12 06:36 UTC
Bad Web Bot
🇩🇪
LRob
2026-11-11 04:06:08
UTC ·
(4 days ago)
WordPress login brute force | path: /wp-login.php | ua: Mozilla/5.0 (X11; Linux x86_64; rv:148.0) Gecko/20100101 Firefox/148.0 | 2026-11-11 04:06 UTC
Brute-Force
Web App Attack
🇫🇷
LRob
2026-11-10 09:28:23
UTC ·
(5 days ago)
Not following 301 redirects — wasted requests | method: GET | path: /xmlrpc.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Bad Web Bot
🇩🇪
big-cloud.nl
2026-11-10 01:20:34
UTC ·
(5 days ago)
Try to access /xmlrpc.php
Web App Attack
🇩🇪
LRob
2026-11-10 00:23:38
UTC ·
(5 days ago)
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (X11; Linux x86_64; rv:148.0) Gecko/20100101 Firefox/148.0 | 2026-11-10 00:23 UTC
Bad Web Bot
🇩🇪
Vegascosmetics
2026-11-09 19:42:00
UTC ·
(5 days ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after first-seen suspicion / AbuseIPDB reputation policy (no URL signature). Evidence: Suspicion-Ban (Score 71>=65, Abuse 72, NonEU, first-seen)
Hacking
Exploited Host
Web App Attack
🇺🇸
cwytech
2026-11-09 16:05:56
UTC ·
(5 days ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-login-lockdown-high.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 07:17:25
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 169.224.96.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 02:17:20.479121 2026] [security2:error] [pid 6099:tid 6099] [client 169.224.96.99:1306] ModS ...
show more
(mod_security) mod_security (id:225170) triggered by 169.224.96.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 02:17:20.479121 2026] [security2:error] [pid 6099:tid 6099] [client 169.224.96.99:1306] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||graymatterofdc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "graymatterofdc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au7QgDKVl1IBioSNBaGVoQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-11-06 23:11:45
UTC ·
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 19:36:36
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 169.224.96.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 14:36:29.712339 2026] [security2:error] [pid 25101:tid 25101] [client 169.224.96.99:1512] Mo ...
show more
(mod_security) mod_security (id:225170) triggered by 169.224.96.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 14:36:29.712339 2026] [security2:error] [pid 25101:tid 25101] [client 169.224.96.99:1512] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jfddrones.cosentient.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jfddrones.cosentient.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "au4sPRJGMx6lpdVfeovM_QAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 18:31:07
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 169.224.96.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 13:31:01.402143 2026] [security2:error] [pid 5646:tid 5646] [client 169.224.96.99:1314] ModS ...
show more
(mod_security) mod_security (id:225170) triggered by 169.224.96.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 13:31:01.402143 2026] [security2:error] [pid 5646:tid 5646] [client 169.224.96.99:1314] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||microkerneltechnologies.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "microkerneltechnologies.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au4c5cJvz4PAYmEJFWCCrQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 10:55:10
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 169.224.96.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:55:07.347352 2026] [security2:error] [pid 12820:tid 12820] [client 169.224.96.99:1440] Mo ...
show more
(mod_security) mod_security (id:225170) triggered by 169.224.96.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:55:07.347352 2026] [security2:error] [pid 12820:tid 12820] [client 169.224.96.99:1440] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||internetnameregistration.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "internetnameregistration.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "au2yC6AhQ8EfABrYgA0L9QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
