🇺🇸
TPI-Abuse
2026-11-12 17:38:56
UTC ·
(15 hours ago)
(mod_security) mod_security (id:225170) triggered by 181.78.83.214 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 12:38:39.140056 2026] [security2:error] [pid 21253:tid 21253] [client 181.78.83.214:58030] M ...
show more
(mod_security) mod_security (id:225170) triggered by 181.78.83.214 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 12:38:39.140056 2026] [security2:error] [pid 21253:tid 21253] [client 181.78.83.214:58030] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||greensandbeans.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "greensandbeans.us"] [uri "/wp-json/wp/v2/users"] [unique_id "avX5n_Ib1CEuZ-eMOCIDZQAAAA8"], referer: https://greensandbeans.us/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
computertrendz
2026-11-11 21:20:02
UTC ·
(1 day ago)
Blocked by os-abuseipdb; 5 hits, proto=udp, ports=443
Port Scan
Hacking
🇲🇹
Malta
2026-11-11 17:30:47
UTC ·
(1 day ago)
181.78.83.214 - - [11/Nov/2026:18:30:47 +0100] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36"
Brute-force password attempt
Hacking
Web App Attack
Brute-Force
🇩🇪
ghostwarriors
2026-11-10 16:20:32
UTC ·
(2 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-10 16:07:41
UTC ·
(2 days ago)
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0 ...
show more
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Sa
Requested, e.g.:
- uat.[REDACTED]/xmlrpc.php
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 15:18:45
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 181.78.83.214 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:18:29.211497 2026] [security2:error] [pid 3221:tid 3221] [client 181.78.83.214:51364] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 181.78.83.214 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:18:29.211497 2026] [security2:error] [pid 3221:tid 3221] [client 181.78.83.214:51364] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||targetbinario.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "targetbinario.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avM1xYnT5QFpkmW7Ii7JngAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 12:49:40
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 181.78.83.214 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 07:49:32.777663 2026] [security2:error] [pid 4407:tid 4407] [client 181.78.83.214:36498] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 181.78.83.214 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 07:49:32.777663 2026] [security2:error] [pid 4407:tid 4407] [client 181.78.83.214:36498] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||frelsburg.com.cajunfriedturkey.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "frelsburg.com.cajunfriedturkey.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avMS3P-zoHBpHNZHV6UVBAAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇷
setupgr
2026-11-10 02:46:12
UTC ·
(3 days ago)
(wplogin_block) Blocked WP-Login Access Attempt 181.78.83.214 (CO/Colombia/Bogota D.C./Bogotá/-/[AS52468 UFINET PANAMA S.A.]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 181.78.83.214 - - [10/Nov/2026:04:4 ...
show more
(wplogin_block) Blocked WP-Login Access Attempt 181.78.83.214 (CO/Colombia/Bogota D.C./Bogotá/-/[AS52468 UFINET PANAMA S.A.]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 181.78.83.214 - - [10/Nov/2026:04:45:53 +0200] "POST /wp-login.php HTTP/2.0" 200 11068 "https://ftiaxtomonosou.gr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-11-07 07:03:45
UTC ·
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 181.78.83.214 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 02:03:30.529999 2026] [security2:error] [pid 16058:tid 16058] [client 181.78.83.214:35944] M ...
show more
(mod_security) mod_security (id:225170) triggered by 181.78.83.214 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 02:03:30.529999 2026] [security2:error] [pid 16058:tid 16058] [client 181.78.83.214:35944] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||tigerpathteam.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tigerpathteam.org"] [uri "/wp-json/wp/v2/users"] [unique_id "au7NQkc8tfaYr9p8Ic8FhwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
lostswordfish.com
2026-11-05 20:08:04
UTC ·
(1 week ago)
Wordfence waf block on parsol
Web App Attack
🇬🇧
foxxelabs
2026-11-05 18:11:18
UTC ·
(1 week ago)
Automated report from FoxxeLabs Sentinel. Path probed: /wp-login.php | Project: anseo | Reason(s): Known exploit path: /wp-login.php | User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Cr
Web App Attack
2026-11-05 15:15:04
UTC ·
(1 week ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Blocked by User-Agent Filter (Bad Bot Pattern: MSIE 9.): Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/3.1) | UA: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/3.1) | (Magento Site)
show less
Hacking
Bad Web Bot
🇮🇩
IndoAbuse
2026-11-05 04:58:46
UTC ·
(1 week ago)
Wordfence 503 block: Repeated malicious requests and bot attacks blocked by WAF.
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-11-05 01:10:01
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇩🇪
LRob
2026-11-04 11:24:53
UTC ·
(1 week ago)
Web exploit attempt | method: GET | path: / | query: author=1&_fields=slug | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 | 2026-11-04 11:24 UTC
Hacking
Web App Attack
