🇺🇸
TPI-Abuse
2026-10-26 09:36:23
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 176.131.13.171 (176.131-13-171.abo.bbox.fr): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 176.131.13.171 (176.131-13-171.abo.bbox.fr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 05:36:15.376601 2026] [security2:error] [pid 4306:tid 4306] [client 176.131.13.171:59174] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.fundingangelinvestors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.fundingangelinvestors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "at8fDwPlVmDf51P7s9tbEgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇿
Tripwire
2026-10-24 03:07:58
(4 days ago)
Wordpress login attempts
Brute-Force
Web App Attack
2026-10-21 03:03:20
(1 week ago)
Network service scanning detected by FortiGate; source quarantined.
Port Scan
🇩🇪
Hazzard
2026-10-16 20:01:40
(1 week ago)
(wordpress) Failed wordpress login from 176.131.13.171 (FR/France/Essonne/Évry/176.131-13-171.abo.bb ...
show more
(wordpress) Failed wordpress login from 176.131.13.171 (FR/France/Essonne/Évry/176.131-13-171.abo.bbox.fr/[redacted]): (CF_ENABLE)
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-10-16 19:42:08
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 176.131.13.171 (176.131-13-171.abo.bbox.fr): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 176.131.13.171 (176.131-13-171.abo.bbox.fr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 15:42:03.654581 2026] [security2:error] [pid 28709:tid 28709] [client 176.131.13.171:62508] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||astglobaltech.com.greenlight.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "astglobaltech.com.greenlight.us"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atJ-C8D2JCgxW72a9-qgfAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
Mugen
2026-10-15 00:20:13
(1 week ago)
Unauthorized VPN login attempts
Brute-Force
🇺🇸
TPI-Abuse
2026-10-14 19:46:01
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 176.131.13.171 (176.131-13-171.abo.bbox.fr): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 176.131.13.171 (176.131-13-171.abo.bbox.fr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 15:45:57.025928 2026] [security2:error] [pid 28827:tid 28827] [client 176.131.13.171:61186] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||prcomputersolutions.com.anthonyanimalclinic.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "prcomputersolutions.com.anthonyanimalclinic.net"] [uri "/wp-json/wp/v2/users"] [unique_id "as_b9azQQcdfcz8_PEXUCQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Packets-Decreaser.NET
2026-10-12 15:33:52
(2 weeks ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇩🇪
FeG Deutschland
2026-10-11 21:00:01
(2 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇩🇪
Packets-Decreaser.NET
2026-10-11 01:19:23
(2 weeks ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
TPI-Abuse
2026-10-10 05:23:42
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 176.131.13.171 (176.131-13-171.abo.bbox.fr): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 176.131.13.171 (176.131-13-171.abo.bbox.fr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 01:23:39.833478 2026] [security2:error] [pid 843:tid 843] [client 176.131.13.171:61580] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cynosurehomeservices.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cynosurehomeservices.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "asnL2yqTLKzTR4B3PQ0zFQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇿
Tripwire
2026-09-30 14:35:21
(3 weeks ago)
Wordpress login attempts
Brute-Force
Web App Attack
🇩🇪
FeG Deutschland
2026-09-20 07:01:46
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇺🇸
lostswordfish.com
2026-09-09 08:06:03
(1 month ago)
Wordfence waf block on uvfousor WPIDD
Web App Attack
🇫🇷
Zkillu
2026-08-19 22:29:22
(2 months ago)
UDP flood (DDoS) vs AS215599: 5771 pkts / 8.25 MB to UDP 80/8443 across 572 dst IP(s), 2026-08-19 21 ...
show more
UDP flood (DDoS) vs AS215599: 5771 pkts / 8.25 MB to UDP 80/8443 across 572 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
DDoS Attack
Exploited Host
