🇺🇸
TPI-Abuse
2026-01-04 10:26:37
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserve ...
show more
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 05:26:33.724748 2026] [security2:error] [pid 11655:tid 11655] [client 184.168.97.210:60478] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.theamarals.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.theamarals.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aVpAWfbmI7tD-PM1gXJDMgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-04 10:04:36
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserve ...
show more
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 05:04:30.092717 2026] [security2:error] [pid 30656:tid 30656] [client 184.168.97.210:38348] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.ritterlien.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.ritterlien.com"] [uri "/wp-json/wp/V2/users"] [unique_id "aVo7LrFHCNuUkjwlCmnhMgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
myagent.site
2026-01-04 09:28:40
(5 months ago)
Blocking for trying to access an exploit file: /xmlrpc.php
Hacking
🇩🇪
LRob.fr
2026-01-04 09:03:06
(5 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-04 07:37:54
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserve ...
show more
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 02:37:46.508940 2026] [security2:error] [pid 27706:tid 27706] [client 184.168.97.210:47508] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.starcrestsales.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.starcrestsales.com"] [uri "/wp-json/wp/V2/users"] [unique_id "aVoYygPwKOkPFKRaNMZCZAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-11 04:06:03
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserve ...
show more
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 23:05:58.025316 2025] [security2:error] [pid 24092:tid 24092] [client 184.168.97.210:14870] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||targetbinario.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "targetbinario.com"] [uri "/wp-json/Wp/v2/users"] [unique_id "aTpDJgwzSBTIgn68gZZ7_gAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
paissangroup
2025-11-25 08:17:58
(6 months ago)
Multiple WAF Violations
Web App Attack
2025-11-09 18:30:04
(7 months ago)
Failed Wordpress Logins
Web App Attack
2025-11-08 10:00:23
(7 months ago)
Failed Wordpress Logins
Web App Attack
2025-11-07 02:12:42
(7 months ago)
Failed Wordpress Logins
Web App Attack
🇩🇪
R.G.
2025-11-06 17:56:56
(7 months ago)
(XMLRPCorWHATEVER) Get lost please 184.168.97.210 (SG/Singapore/210.97.168.184.host.secureserver.net ...
show more
(XMLRPCorWHATEVER) Get lost please 184.168.97.210 (SG/Singapore/210.97.168.184.host.secureserver.net): 3 in the last 900 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇬🇧
spamverify.com
2025-11-06 01:01:53
(7 months ago)
Honeypot Hit: xmlrpc.php
Web Spam
Blog Spam
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-05 20:23:10
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserve ...
show more
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 05 15:23:06.591659 2025] [security2:error] [pid 22530:tid 22530] [client 184.168.97.210:61028] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.edgebiopharma.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.edgebiopharma.com"] [uri "/wp-json/wp/v2/users.json"] [unique_id "aQuyKvVG14te0PwEtDQZOQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-05 14:47:28
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserve ...
show more
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 05 09:47:20.592561 2025] [security2:error] [pid 16630:tid 16634] [client 184.168.97.210:58396] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.jofdt.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.jofdt.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aQtjeGFRWndT2z71YoyfGAAAAME"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-05 00:18:06
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserve ...
show more
(mod_security) mod_security (id:225170) triggered by 184.168.97.210 (210.97.168.184.host.secureserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 04 19:18:03.142170 2025] [security2:error] [pid 17731:tid 17754] [client 184.168.97.210:45324] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.teddysdeli.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.teddysdeli.com"] [uri "/wp-json/wp/V2/users"] [unique_id "aQqXuxif0lf-oFcMl9fn2QAAAJc"]
show less
Brute-Force
Bad Web Bot
Web App Attack