🇳🇱
Alt255
2026-09-22 17:17:15
(5 days ago)
[ti-01sc] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpr ...
show more
[ti-01sc] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 178.20.215.56 - - [22/Sep/2026:19:16:42 +0200] "POST /xmlrpc.php HTTP/2.0" 403 90 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
178.20.215.56 - - [22/Sep/2026:19:16:56 +0200] "POST /wp-login.php HTTP/2.0" 200 4486 "https://www.nieuwsvoordietisten.nl/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
178.20.215.56 - - [22/Sep/2026:19:16:58 +0200] "POST /xmlrpc.php HTTP/2.0" 403 87 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15"
178.20.215.56 - - [22/Sep/2026:19:17:14 +0200] "POST /wp-login.php HTTP/2.0" 200 4486 "https://www
...
show less
Brute-Force
Web App Attack
🇫🇮
bittiguru.fi
2026-09-21 08:58:27
(6 days ago)
178.20.215.56 - [21/Sep/2026:11:57:36 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 ...
show more
178.20.215.56 - [21/Sep/2026:11:57:36 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" "4.66"
178.20.215.56 - [21/Sep/2026:11:58:26 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" "4.66"
...
show less
Hacking
Brute-Force
Web App Attack
🇺🇸
oralunal
2026-09-21 06:59:01
(6 days ago)
IP banned by Fail2Ban in jail ente-suss ente.com-ssl_log mvfnds
...
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-09-21 04:15:08
(6 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-09-14 00:10:01
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
2026-09-07 04:23:09
(2 weeks ago)
Fail2ban filtered
...
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 06:18:25
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 178.20.215.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 178.20.215.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 02:18:21.248978 2026] [security2:error] [pid 2141540:tid 2141540] [client 178.20.215.56:10229] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rucomp.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rucomp.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adXzLb1WtAh49ZEOUbIJIgAAAAI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-01 05:48:00
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 178.20.215.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 178.20.215.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 01:47:55.554597 2026] [security2:error] [pid 12411:tid 12411] [client 178.20.215.56:36635] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rannals.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rannals.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acyxi156QF9ZlTlP6oprtAAAAAE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-03-26 19:57:26
(6 months ago)
Detected attack and reported by a human
Brute-Force
Web App Attack
SSH
DDoS Attack
Exploited Host
Bad Web Bot
🇨🇭
backslash
2026-03-26 19:27:00
(6 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2026-03-25 08:26:56
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 178.20.215.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 178.20.215.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 04:26:47.970260 2026] [security2:error] [pid 30931:tid 30931] [client 178.20.215.56:26451] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||majersigns.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "majersigns.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acOcRy4AzzR9804TPPVneQAAAAM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
DocNetzwerk
2025-12-27 06:00:01
(9 months ago)
(wordpress) Failed wordpress login from 178.20.215.56 (SC/Seychelles/-)
Brute-Force
🇺🇸
TPI-Abuse
2025-12-24 10:15:16
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 178.20.215.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 178.20.215.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 24 05:15:12.180126 2025] [security2:error] [pid 8844:tid 8844] [client 178.20.215.56:29399] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||primacomm.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "primacomm.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aUu9MEkN_V6F4jU1xpRzqwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇭🇷
IgorS.zg.hr
2025-03-04 18:27:19
(1 year ago)
Web application attack detected by fail2ban
Hacking
Web App Attack
2024-09-16 01:19:14
(2 years ago)
178.20.215.56 (GB/United Kingdom/-), 5 distributed imapd attacks on account [redacted]
Brute-Force
