🇺🇸
TPI-Abuse
2026-10-22 23:11:17
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 170.168.243.117 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210350) triggered by 170.168.243.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 19:11:13.864680 2026] [security2:error] [pid 2790:tid 2790] [client 170.168.243.117:29455] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||keymarketmedia.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "keymarketmedia.com"] [uri "/connections2sampscript2.html"] [unique_id "atqYEbhuXvRxXOhwBkaV1wAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-09-02 23:57:37
(1 month ago)
[ThuSep0301:57:34.8555962026][security2:error][pid2122256:tid2122328][client170.168.243.117:0]ModSec ...
show more
[ThuSep0301:57:34.8555962026][security2:error][pid2122256:tid2122328][client170.168.243.117:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"alessandrolucchini.ch\"][uri\"/xmlrpc.php\"][unique_id\"api37uhP7Yb0xWUlPJWrUgAAAFM\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
IndigoRidge
2026-08-25 12:17:33
(2 months ago)
170.168.243.117 - - [25/Aug/2026:08:17:30 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5090 "-" "Mozilla/5 ...
show more
170.168.243.117 - - [25/Aug/2026:08:17:30 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5090 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
170.168.243.117 - - [25/Aug/2026:08:17:30 -0400] "GET /wp-login.php HTTP/1.0" 200 12546 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
170.168.243.117 - - [25/Aug/2026:08:17:31 -0400] "POST /wp-login.php HTTP/1.0" 200 13004 "https://thecarolinalens.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
170.168.243.117 - - [25/Aug/2026:08:17:33 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5090 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
170.168.243.117 - - [25/Aug/2026:08:17:33 -0400] "GET /wp-login.php HTTP/1.0" 200 12546 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15"
...
show less
Web App Attack
🇲🇽
Centynova Corp.
2026-07-22 00:06:58
(3 months ago)
Blocked by threat detection service. Centynova Security [Fuerza bruta y Ataque a servicios web]
Brute-Force
Web App Attack
🇩🇪
LRob
2026-07-21 19:02:07
(3 months ago)
CrowdSec: lrob/wp-xmlrpc-bf | req: /xmlrpc.php | UA: curl/7.88.1
Brute-Force
Web App Attack
2026-07-21 14:57:35
(3 months ago)
[osotir.org] httpd-login-spray-site: sites=www.synathlountes.agonistes.gr; logs=/var/log/httpd/domai ...
show more
[osotir.org] httpd-login-spray-site: sites=www.synathlountes.agonistes.gr; logs=/var/log/httpd/domains/agonistes.gr.synathlountes.log; samples=site_wide=true | distinct_ips=10 | /wp-login.php
show less
Hacking
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-07-16 01:42:11
(3 months ago)
HTTP flood against /retreat-corp on Apache webserver
Brute-Force
🇺🇸
nationaleventpros.com
2026-06-22 00:43:52
(4 months ago)
WordPress login attempt
Brute-Force
🇩🇪
LRob
2026-06-09 14:15:15
(4 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-02-08 19:50:06
(8 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.243.117 (DE/Germany/-): 1 in the last ...
show more
(modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.243.117 (DE/Germany/-): 1 in the last 3600 secs (0-196)
show less
Hacking
🇺🇸
TPI-Abuse
2026-01-23 05:32:55
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 170.168.243.117 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 170.168.243.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 23 00:32:52.026373 2026] [security2:error] [pid 22966:tid 22966] [client 170.168.243.117:64071] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||artspacecleveland.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "artspacecleveland.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aXMIBM9cbH_1_H6qHDsZXgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-22 23:32:51
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 170.168.243.117 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 170.168.243.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 18:32:44.156979 2026] [security2:error] [pid 1648083:tid 1648083] [client 170.168.243.117:50243] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||tigerpathteam.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tigerpathteam.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aXKznGJBlnkjqin2Ek8jrgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-22 12:47:28
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 170.168.243.117 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 170.168.243.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 07:47:21.962698 2026] [security2:error] [pid 25074:tid 25074] [client 170.168.243.117:16969] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cmcnow.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cmcnow.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXIcWVMDwn1IpdnBTnEVSgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
