๐บ๐ธ
TPI-Abuse
2026-10-28 02:51:12
(9 hours ago)
(mod_security) mod_security (id:225170) triggered by 170.238.34.196 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 170.238.34.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 22:50:54.838166 2026] [security2:error] [pid 18268:tid 18297] [client 170.238.34.196:45714] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.luxury.property-management-companies-chicago.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.luxury.property-management-companies-chicago.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "auFjDmI-ruHYmpfRo-SxeAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฎ๐น
CoreTech srl
2026-10-26 19:08:58
(1 day ago)
cloudlinux2 fail2ban: 2026-10-26 20:05:39,765 fail2ban.filter [1596]: INFO [plesk-modsecu ...
show more
cloudlinux2 fail2ban: 2026-10-26 20:05:39,765 fail2ban.filter [1596]: INFO [plesk-modsecurity] Found 154.125.204.75 - 2026-10-26 20:05:39cloudlinux2 fail2ban: 2026-10-26 20:05:40,725 fail2ban.filter [1596]: INFO [plesk-modsecurity] Found 154.125.204.75 - 2026-10-26 20:05:40cloudlinux2 fail2ban: 2026-10-26 20:05:46,897 fail2ban.actions [1596]: NOTICE [plesk-modsecurity] Ban 102.138.109.148cloudlinux2 fail2ban: 2026-10-26 20:05:41,907 fail2ban.filter [1596]: INFO [plesk-modsecurity] Found 102.138.109.148 - 2026-10-26 20:05:41cloudlinux2 fail2ban: 2026-10-26 20:05:46,858 fail2ban.filter [1596]: INFO [plesk-modsecurity] Found 102.138.109.148 - 2026-10-26 20:05:46cloudlinux2 fail2ban: 2026-10-26 20:05:47,260 fail2ban.filter [1596]: INFO [plesk-modsecurity] Found 197.50.47.87 - 2026-10-26 20:05:47cloudlinux2 fail2ban: 2026-10-26 20:05:46,903 fail2ban.filter [1596]: INFO [recidive] Found 102.138.109.148 - 2026-10-26 20:05:46cloudlinux2 fail2ba
show less
Brute-Force
๐บ๐ธ
TPI-Abuse
2026-10-26 14:16:45
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 170.238.34.196 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 170.238.34.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 10:16:28.849575 2026] [security2:error] [pid 11603:tid 11603] [client 170.238.34.196:57344] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||magacine.tv|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "magacine.tv"] [uri "/wp-json/wp/v2/users"] [unique_id "at9gvODPF_v1Gb7Db554sAAAADc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
HJ5Ss4Ju
2026-10-26 00:17:53
(2 days ago)
Wordfence firewall block
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-25 02:25:42
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 170.238.34.196 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 170.238.34.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 22:25:26.110174 2026] [security2:error] [pid 28510:tid 28510] [client 170.238.34.196:38198] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thenolangroup.llc|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thenolangroup.llc"] [uri "/wp-json/wp/v2/users/me"] [unique_id "at1olmn0m2ke74Vbi7jbgwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ซ๐ท
masterguru
2026-10-24 07:01:03
(4 days ago)
WordPress: User enumeration. Pattern match "(author\\\\= (88030-197)
Hacking
๐บ๐ธ
TPI-Abuse
2026-10-24 05:02:41
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 170.238.34.196 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 170.238.34.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 01:02:27.283732 2026] [security2:error] [pid 15084:tid 15084] [client 170.238.34.196:54376] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||prcomputersolutions.com.anthonyanimalclinic.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "prcomputersolutions.com.anthonyanimalclinic.net"] [uri "/wp-json/wp/v2/users"] [unique_id "atw74-_tXv1iIFMNGVJzfwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฉ๐ช
FeG Deutschland
2026-10-22 11:23:16
(6 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 24
Exploited Host
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-22 05:00:39
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 170.238.34.196 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 170.238.34.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 01:00:21.343343 2026] [security2:error] [pid 2615:tid 2615] [client 170.238.34.196:42652] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||maprada92.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "maprada92.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atmYZfg3tqwvaCWpD9X4lwAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ซ๐ท
LRob
2026-10-19 01:00:31
(1 week ago)
Not following 301 redirects โ wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 ...
show more
Not following 301 redirects โ wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
show less
Bad Web Bot
๐ฉ๐ช
LRob
2026-10-17 00:05:10
(1 week ago)
Calendar filter flood (L7 DDoS) | host: www.escrimeaura.fr | path: /calendrier-2/action~agenda/time_ ...
show more
Calendar filter flood (L7 DDoS) | host: www.escrimeaura.fr | path: /calendrier-2/action~agenda/time_limit~1762815600/cat_ids~157/tag_ids~668,214,331,615,455,585,439,540/request_format~json/ | src_port: 50218
show less
DDoS Attack
Web App Attack
๐ฉ๐ช
FeG Deutschland
2026-10-16 22:58:34
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
๐จ๐ฟ
Countryman
2026-09-29 00:10:02
(4 weeks ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
๐บ๐ธ
้ฌผๅฝฑ233
2026-09-24 11:37:12
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ...
show more
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
show less
Bad Web Bot
๐บ๐ธ
kosada.com
2026-09-07 00:32:29
(1 month ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]/search?f%5B0 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]/search?f%5B0%5D=digest_key_terms%3A317&f%5B1%5D=digest_key_terms%3A318&f%5B2%5D=digest_key_terms%3A380&f%5B3%5D=digest_key_terms%3A526&f%5B4%5D=digest_publication_type%3A927&field_article_edition%5B504%5D=504&field_key_terms%5B358%5D=358 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0")
show less
DDoS Attack
Bad Web Bot
