🇺🇸
bazter.pro
2026-03-25 11:03:13
(2 months ago)
Auto-Ban [2026-03-25 13:03:08]: CRITICAL: Sensitive files (2); DC: NETLABS LLC [Paths: 2] | Details: ...
show more
Auto-Ban [2026-03-25 13:03:08]: CRITICAL: Sensitive files (2); DC: NETLABS LLC [Paths: 2] | Details: Sensitive files/paths: /xmlrpc.php, /xmlrpc.php | Other paths: /wp-login.php, /xmlrpc.php
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-03-24 21:41:32
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 185.168.31.57 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.168.31.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 24 17:41:28.767391 2026] [security2:error] [pid 27353:tid 27353] [client 185.168.31.57:9537] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||puoci.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "puoci.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acMFCLjKKWP8qMuRD2liLAAAAA0"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-23 18:35:45
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 185.168.31.57 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.168.31.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 23 14:35:38.306138 2026] [security2:error] [pid 3810098:tid 3810098] [client 185.168.31.57:21687] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nekstlevel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nekstlevel.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acGH-gNNGkD872OjJ1EeNwAAAAU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-03-22 06:21:35
(2 months ago)
DDoS-SZ
DDoS Attack
🇺🇸
TPI-Abuse
2026-03-21 16:37:57
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 185.168.31.57 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.168.31.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 12:37:50.996889 2026] [security2:error] [pid 17124:tid 17124] [client 185.168.31.57:23049] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||sophcomp.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sophcomp.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab7JXiCI0oVwaaIRriSMKgAAAAs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
rsiddall
2026-03-19 10:28:31
(3 months ago)
185.168.31.57 - - [19/Mar/2026:06:28:24 -0400] "POST /xmlrpc.php HTTP/1.1" 403 1809 "-" "Apache-Http ...
show more
185.168.31.57 - - [19/Mar/2026:06:28:24 -0400] "POST /xmlrpc.php HTTP/1.1" 403 1809 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
185.168.31.57 - - [19/Mar/2026:06:28:30 -0400] "POST /xmlrpc.php HTTP/1.1" 403 1809 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
...
show less
Brute-Force
2026-03-16 15:40:08
(3 months ago)
| [Dangerous/Iran] Aggressive IP 185.168.31.57 (~30 hits). Type: DoS Defender- Web server 400 error ...
show more
| [Dangerous/Iran] Aggressive IP 185.168.31.57 (~30 hits). Type: DoS Defender- Web server 400 error code
show less
Web App Attack
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-03-16 14:48:11
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 185.168.31.57 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 185.168.31.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 16 10:48:04.672420 2026] [security2:error] [pid 8321:tid 8321] [client 185.168.31.57:31347] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 185.168.31.57 (+1 hits since last alert)|wave94.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "wave94.com"] [uri "/xmlrpc.php"] [unique_id "abgYJDsDL5_Uvr0PLJtlEQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
kjaerulff
2026-03-11 15:27:41
(3 months ago)
Failed Wordpress login using wp-login.php
Web App Attack
2026-03-05 12:59:28
(3 months ago)
[redacted] 185.168.31.57 - - [05/Mar/2026:13:59:14 +0100] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "A ...
show more
[redacted] 185.168.31.57 - - [05/Mar/2026:13:59:14 +0100] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
[redacted] 185.168.31.57 - - [05/Mar/2026:13:59:24 +0100] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
[redacted] 185.168.31.57 - - [05/Mar/2026:13:59:25 +0100] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
[redacted] 185.168.31.57 - - [05/Mar/2026:13:59:26 +0100] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
[redacted] 185.168.31.57 - - [05/Mar/2026:13:59:27 +0100] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
...
show less
Hacking
Web App Attack
🇩🇪
MusicLibrary
2026-03-04 02:55:37
(3 months ago)
Attempted access to non existent wordpress urls
Bad Web Bot
🇺🇸
TPI-Abuse
2026-03-01 08:46:36
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 185.168.31.57 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.168.31.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 01 03:46:29.777031 2026] [security2:error] [pid 22415:tid 22415] [client 185.168.31.57:41463] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||h-mod.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "h-mod.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaP85SZUSb6Mt8xIcgOSJgAAAAk"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack