🇩🇪
rh24
2026-10-13 18:18:39
(1 week ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 170.168.30.12 (-)
Bad Web Bot
🇩🇪
Hazzard
2026-10-12 16:53:17
(1 week ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted]): (CF_ENABLE)
Bad Web Bot
🇨🇭
Origon
2026-10-12 15:05:03
(1 week ago)
http-bad-user-agent - IP: 170.168.30.12 - time="2026-10-12T17:05:02+02:00" level=info msg="(555f66b ...
show more
http-bad-user-agent - IP: 170.168.30.12 - time="2026-10-12T17:05:02+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-bad-user-agent by ip 170.168.30.12 (NL/59651) : 4h ban on Ip 170.168.30.12" module=db
show less
Bad Web Bot
2026-10-05 13:35:32
(2 weeks ago)
Automated scanner probing RD Web Access login pages
Bad Web Bot
Web App Attack
2026-09-30 20:41:20
(3 weeks ago)
Multiple failed login attemps RDS-Web-Access-Server
Brute-Force
Web App Attack
🇪🇸
librebit
2026-09-27 00:04:13
(4 weeks ago)
Brute force
Brute-Force
🇪🇸
Gem
2026-09-18 22:11:56
(1 month ago)
Unauthorized web scan.
Web App Attack
🇨🇿
Countryman
2026-09-14 00:10:01
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇳🇱
WeCloudit-Anti-Abuse
2026-07-16 14:32:23
(3 months ago)
HTTP flood against /retreat-corp on Apache webserver
Brute-Force
🇬🇧
adnscom.net
2026-04-04 13:40:32
(6 months ago)
IPS trigger: Brute force WebApp/CMS scanning/attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-28 20:52:13
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 170.168.30.12 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 170.168.30.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 28 16:52:08.581596 2026] [security2:error] [pid 11639:tid 11639] [client 170.168.30.12:35577] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ccoxes.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ccoxes.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acg_ePBPaCsLms-lh6RtmgAAABA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-28 16:26:05
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 170.168.30.12 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 170.168.30.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 28 12:26:00.260885 2026] [security2:error] [pid 11243:tid 11243] [client 170.168.30.12:44603] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||wea-inc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "wea-inc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acgBGPYccEdJYivY2Ah-GQAAAAM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-22 18:36:44
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 170.168.30.12 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 170.168.30.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 13:36:37.791087 2026] [security2:error] [pid 10621:tid 10621] [client 170.168.30.12:18015] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hayrun.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hayrun.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXJuNWMiu8FCTDvP-usDFgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-22 11:09:58
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 170.168.30.12 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 170.168.30.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 06:09:51.687787 2026] [security2:error] [pid 5837:tid 5837] [client 170.168.30.12:57241] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||high5-vr.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "high5-vr.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXIFf-q4Nod2T6o7v4FLkQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
Johan Finn
2025-12-02 04:03:51
(10 months ago)
malicious activity
Web App Attack
