🇳🇱
middelkoopcc
2026-06-15 19:30:05
(2 days ago)
2026-06-15 21:28:05 WordPress login error from 178.238.46.51: incorrect_password && 2026-06-15 21:28 ...
show more
2026-06-15 21:28:05 WordPress login error from 178.238.46.51: incorrect_password && 2026-06-15 21:28:05 WordPress login error from 178.238.46.51: incorrect_password && 2026-06-15 21:28:06 WordPress login error from 178.238.46.51: incorrect_password && 141 more within 20 minutes
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-06-15 18:21:15
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (exchange.acemail.eu): 1 in the l ...
show more
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (exchange.acemail.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 14:21:10.352312 2026] [security2:error] [pid 12451:tid 12451] [client 178.238.46.51:42186] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.holgerfeld.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.holgerfeld.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajBCljD_63EEHfvC2fKFnAAAADQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-15 14:12:57
(2 days ago)
[redacted] 178.238.46.51 - - [15/Jun/2026:16:12:32 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "M ...
show more
[redacted] 178.238.46.51 - - [15/Jun/2026:16:12:32 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0"
[redacted] 178.238.46.51 - - [15/Jun/2026:16:12:36 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0"
[redacted] 178.238.46.51 - - [15/Jun/2026:16:12:52 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0"
[redacted] 178.238.46.51 - - [15/Jun/2026:16:12:53 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0"
[redacted] 178.238.46.51 - - [15/Jun/2026:16:12:55 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:53.0) Gecko/20100101 Firefox/53.0"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 03:54:54
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (exchange.acemail.eu): 1 in the l ...
show more
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (exchange.acemail.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 23:54:46.125182 2026] [security2:error] [pid 9385:tid 9385] [client 178.238.46.51:43412] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.paleopathologist.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.paleopathologist.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai93hizDMvk-J0MVKbBZiwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-06-14 23:51:14
(2 days ago)
(wp_login_try) srv101 WP Login Attempt 178.238.46.51 (CZ/Czechia/exchange.acemail.eu): 10 in the las ...
show more
(wp_login_try) srv101 WP Login Attempt 178.238.46.51 (CZ/Czechia/exchange.acemail.eu): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 22:42:24
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (exchange.acemail.eu): 1 in the l ...
show more
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (exchange.acemail.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 18:42:20.090240 2026] [security2:error] [pid 30783:tid 30783] [client 178.238.46.51:44338] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.bolivarbulletintimes.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.bolivarbulletintimes.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai8uTHjuPkR1WQXxBwjOYQAAAJU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 07:13:47
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (exchange.acemail.eu): 1 in the l ...
show more
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (exchange.acemail.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 03:13:42.541662 2026] [security2:error] [pid 16260:tid 16260] [client 178.238.46.51:50690] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.ftiptondds.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.ftiptondds.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai5UpgjtoFLEow2lxSOX_AAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 19:23:49
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (server.esuba.eu): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (server.esuba.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 15:23:42.292095 2026] [security2:error] [pid 2316:tid 2316] [client 178.238.46.51:35542] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.kidswow.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.kidswow.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai2uPoiJgN2_VW99Xkq6tAAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 18:37:07
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (server.esuba.eu): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (server.esuba.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 14:37:00.576804 2026] [security2:error] [pid 8968:tid 8968] [client 178.238.46.51:35506] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.bikinitweets.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.bikinitweets.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai2jTKpPzZDbJMrDApjFigAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 11:08:42
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (exchange.acemail.eu): 1 in the l ...
show more
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (exchange.acemail.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 07:08:37.206437 2026] [security2:error] [pid 18394:tid 18394] [client 178.238.46.51:58008] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.diamondtrailerserv.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.diamondtrailerserv.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiaitTZYBngHFjihZsDhUAAAADs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
tomkolp
2026-06-08 06:00:03
(1 week ago)
CSF/LFD block: XMLRPC,WPLOGIN - Login failure/trigger from 178.238.46.51 (CZ/Czechia/server.esuba.eu ...
show more
CSF/LFD block: XMLRPC,WPLOGIN - Login failure/trigger from 178.238.46.51 (CZ/Czechia/server.esuba.eu): 5 in the last 3600 secs
show less
Bad Web Bot
Web App Attack
Hacking
🇵🇱
tomkolp
2026-06-08 05:38:16
(1 week ago)
CrowdSec - Scenario: crowdsecurity/http-bf-wordpress_bf_xmlrpc. Duration: 4h.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 21:15:15
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (exchange.acemail.eu): 1 in the l ...
show more
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (exchange.acemail.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 17:15:03.547112 2026] [security2:error] [pid 1526:tid 1526] [client 178.238.46.51:45794] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nessmonsters.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nessmonsters.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiXfV1wg6tcLAreKXYJfuQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 17:52:10
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (server.esuba.eu): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (server.esuba.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 13:52:04.933497 2026] [security2:error] [pid 22120:tid 22120] [client 178.238.46.51:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||local639.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "local639.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiWvxFVPvqx7LbXhT-ucfQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 13:31:00
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (server.esuba.eu): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 178.238.46.51 (server.esuba.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 09:30:54.125085 2026] [security2:error] [pid 27407:tid 27407] [client 178.238.46.51:45680] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.ideaofauniversity.website|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.ideaofauniversity.website"] [uri "/wp-json/wp/v2/users"] [unique_id "aiVyjt8Wm_KMAl1FcpI8HQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack