🇵🇱
Budyn
2026-11-14 20:38:50
UTC ·
(10 hours ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_6 | Action: AWS API Call | Token ID: d27dkqjofz7pprlk36nnrvhej | Client tool: silentvs-hitworker/1
Hacking
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-13 21:20:05
UTC ·
(1 day ago)
Web exploit attempt | method: POST, GET | path: /wp-login.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 | 2026-11-13 21:20 UTC
Hacking
Web App Attack
🇩🇪
throny
2026-11-13 10:41:54
UTC ·
(1 day ago)
Used an AWS access key that exists only in a honeypot's fake config file (canary token) at 2026-11-13 10:32 UTC, API call DescribeInstances, client silentvs-hitworker/1
Hacking
Web App Attack
🇺🇸
computertrendz
2026-11-13 06:45:02
UTC ·
(2 days ago)
Blocked by os-abuseipdb; 11 hits, proto=udp, ports=443
Port Scan
Hacking
🇺🇸
lostswordfish.com
2026-11-12 12:20:07
UTC ·
(2 days ago)
Wordfence waf block on registrymatters
Web App Attack
🇩🇪
LRob
2026-11-12 11:00:09
UTC ·
(2 days ago)
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (X11; Linux x86_64; rv:148.0) Gecko/20100101 Firefox/148.0
Bad Web Bot
🇮🇹
LTM
2026-11-12 07:20:02
UTC ·
(2 days ago)
WebServer - Attempts to exploit
Hacking
Brute-Force
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-12 02:25:11
UTC ·
(3 days ago)
[Thu Nov 12 13:25:10.307029 2026] [security2:error] [pid 444218] [client 181.197.89.61:47262] [client 181.197.89.61] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Thu Nov 12 13:25:10.307029 2026] [security2:error] [pid 444218] [client 181.197.89.61:47262] [client 181.197.89.61] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "angleseaarthouse.com.au"] [uri "/xmlrpc.php"] [unique_id "avUjhuW-w1lCNkDucMsavwAAAAE"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 06:35:20
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 181.197.89.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 01:35:15.729719 2026] [security2:error] [pid 30578:tid 30578] [client 181.197.89.61:44472] M ...
show more
(mod_security) mod_security (id:225170) triggered by 181.197.89.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 01:35:15.729719 2026] [security2:error] [pid 30578:tid 30578] [client 181.197.89.61:44472] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nuegrapes.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nuegrapes.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avQMo3KsMrThl7hS4-X_YQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
BlueWire Hosting
2026-11-11 00:34:08
UTC ·
(4 days ago)
Aggressive scanning resulting into 404
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-10 10:29:41
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 181.197.89.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:29:37.001701 2026] [security2:error] [pid 23589:tid 23589] [client 181.197.89.61:57986] M ...
show more
(mod_security) mod_security (id:225170) triggered by 181.197.89.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:29:37.001701 2026] [security2:error] [pid 23589:tid 23589] [client 181.197.89.61:57986] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||americanexportimport.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "americanexportimport.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avLyEPT2upMtmTmaTjFojQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇭🇺
bcsaba
2026-11-05 19:04:59
UTC ·
(1 week ago)
CMS (WordPress or Joomla) login attempt.
181.197.89.61 - - [05/Nov/2026:20:04:57 +0100] "POST /wp-login.php HTTP/2.0" 200 3429 "https://*REDACTED*/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ ...
show more
CMS (WordPress or Joomla) login attempt.
181.197.89.61 - - [05/Nov/2026:20:04:57 +0100] "POST /wp-login.php HTTP/2.0" 200 3429 "https://*REDACTED*/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36"
show less
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 15:47:14
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 181.197.89.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 11:47:10.199836 2026] [security2:error] [pid 4189:tid 4189] [client 181.197.89.61:0] ModSecu ...
show more
(mod_security) mod_security (id:225170) triggered by 181.197.89.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 11:47:10.199836 2026] [security2:error] [pid 4189:tid 4189] [client 181.197.89.61:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ac.cloudex.click|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ac.cloudex.click"] [uri "/wp-json/wp/v2/users/me"] [unique_id "auDHfoYFIMPcahV8VcvCDQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
BlueWire Hosting
2026-10-26 10:06:55
UTC ·
(2 weeks ago)
Aggressive scanning resulting into 404
Bad Web Bot
🇲🇹
Malta
2026-10-25 00:14:38
UTC ·
(3 weeks ago)
181.197.89.61 - - [25/Oct/2026:02:14:37 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
Brute-force password attempt
Hacking
Web App Attack
Brute-Force
