🇺🇸
TPI-Abuse
2026-06-15 02:20:23
(6 minutes ago)
(mod_security) mod_security (id:225170) triggered by 185.177.9.158 (host-185-177-9-158.netiq.sk): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.177.9.158 (host-185-177-9-158.netiq.sk): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 22:20:16.658302 2026] [security2:error] [pid 25010:tid 25016] [client 185.177.9.158:52918] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||chelseyrae.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "chelseyrae.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ai9hYPflWwx5RX0KYqxxoAAAAMM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xxkodedxx
2026-06-15 02:17:40
(9 minutes ago)
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get in 10m window.
...
show more
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get in 10m window.
Active: 02:17:19 UTC
Volume: 2 honeypot probe(s)
Bait taken: /wp-login.php
UA: "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
🇩🇪
Viveronese
2026-06-15 02:17:08
(9 minutes ago)
Wordpress vulnerability scanning
Web App Attack
🇬🇧
consul.to
2026-06-15 02:02:43
(24 minutes ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 01:13:16
(1 hour ago)
(mod_security) mod_security (id:225170) triggered by 185.177.9.158 (host-185-177-9-158.netiq.sk): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.177.9.158 (host-185-177-9-158.netiq.sk): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 21:13:12.224494 2026] [security2:error] [pid 4988:tid 4988] [client 185.177.9.158:33190] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||soudertonbigred.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "soudertonbigred.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ai9RqDmV2yvOQ0by0dCiFgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
andypiper
2026-06-15 01:01:14
(1 hour ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇫🇷
masterguru
2026-06-15 00:26:05
(2 hours ago)
(modsec_5040) ModSec 5040: API Basic Auth blocked from 185.177.9.158 (SK/Slovakia/host-185-177-9-158 ...
show more
(modsec_5040) ModSec 5040: API Basic Auth blocked from 185.177.9.158 (SK/Slovakia/host-185-177-9-158.netiq.sk): 1 in the last 3600 secs (0-196)
show less
Hacking
🇺🇸
TPI-Abuse
2026-06-15 00:04:15
(2 hours ago)
(mod_security) mod_security (id:225170) triggered by 185.177.9.158 (host-185-177-9-158.netiq.sk): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.177.9.158 (host-185-177-9-158.netiq.sk): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 20:04:10.311021 2026] [security2:error] [pid 1246:tid 1269] [client 185.177.9.158:53646] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||permisos.pr|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "permisos.pr"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ai9BekLT99gf00EIHr39BQAAAFM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
AlexEventfahrtenIPDB
2026-06-14 23:49:48
(2 hours ago)
[Mon Jun 15 01:49:46.331679 2026] [authz_core:error] [pid 257315:tid 257315] [client 185.177.9.158:4 ...
show more
[Mon Jun 15 01:49:46.331679 2026] [authz_core:error] [pid 257315:tid 257315] [client 185.177.9.158:49503] AH01630: client denied by server configuration: /var/www/std-sites/cadillac/wp-login.php
[Mon Jun 15 01:49:48.572177 2026] [authz_core:error] [pid 259390:tid 259390] [client 185.177.9.158:52686] AH01630: client denied by server configuration: /var/www/std-sites/cadillac/wp-login.php, referer: https://alex-eventfahrten.spdns.de/wp-login.php
...
show less
Brute-Force
Web App Attack
🇨🇦
polycoda
2026-06-14 23:17:21
(3 hours ago)
📄 Probes for wp-login.php and other inexistent URLs
Hacking
Web App Attack
🇫🇷
tecnicorioja
2026-06-14 22:00:13
(4 hours ago)
POST /xmlrpc.php [14/Jun/2026:05:19:03
Brute-Force
Web App Attack
🇫🇷
Yepngo
2026-06-14 21:56:47
(4 hours ago)
185.177.9.158 - - [14/Jun/2026:23:56:47 +0200] "POST /wp-login.php HTTP/2.0" 200 12097 "https://www. ...
show more
185.177.9.158 - - [14/Jun/2026:23:56:47 +0200] "POST /wp-login.php HTTP/2.0" 200 12097 "https://www.yepngo.com/wp-login.php" "Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 21:28:39
(4 hours ago)
(mod_security) mod_security (id:225170) triggered by 185.177.9.158 (host-185-177-9-158.netiq.sk): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.177.9.158 (host-185-177-9-158.netiq.sk): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 17:28:32.057567 2026] [security2:error] [pid 15146:tid 15146] [client 185.177.9.158:36556] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||arsenalfordemocracy.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ai8dAN1DQFVvUAGdZYJW5gAAAH8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
solution.it
2026-06-14 19:52:18
(6 hours ago)
[Sun Jun 14 21:52:18.166645 2026] [php7:error] [pid 3649727:tid 3649727] [client 185.177.9.158:39460 ...
show more
[Sun Jun 14 21:52:18.166645 2026] [php7:error] [pid 3649727:tid 3649727] [client 185.177.9.158:39460] script '/var/www/html/blog.solution.it/wp-login.php' not found or unable to stat
show less
Web App Attack
🇩🇪
ger-stg-sifi1
2026-06-14 19:50:52
(6 hours ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack