🇺🇸
TPI-Abuse
2026-06-23 03:06:08
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 23:06:02.259884 2026] [security2:error] [pid 14494:tid 14494] [client 185.221.175.68:46658] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rddeckerphotography.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rddeckerphotography.com"] [uri "/blog/wp-json/wp/v2/users"] [unique_id "ajn4GlCfJMHU6sVqoyfW0QAAACg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-19 23:43:21
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 19:43:14.686568 2026] [security2:error] [pid 8591:tid 8611] [client 185.221.175.68:50744] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.pwihatah.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.pwihatah.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajXUEr541CCOrawl8y1UygAAAE4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-19 18:04:07
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 14:04:03.433766 2026] [security2:error] [pid 9050:tid 9050] [client 185.221.175.68:51736] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.splashstation.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.splashstation.org"] [uri "/wp-json/wp/v2/users"] [unique_id "ajWEk3C7bs8ARgTZNF01TQAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-19 10:37:08
(4 days ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 21:43:32
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 17:43:27.353209 2026] [security2:error] [pid 8892:tid 8892] [client 185.221.175.68:54150] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||market1st.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "market1st.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai8gf3Iu0HD74BIZrV7MkAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 08:16:04
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 04:15:59.004000 2026] [security2:error] [pid 5238:tid 5238] [client 185.221.175.68:56022] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.mariettacaseyclub.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.mariettacaseyclub.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aivAP_CTUqqX019atSaR2wAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 12:24:06
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 08:23:58.799469 2026] [security2:error] [pid 29387:tid 29464] [client 185.221.175.68:38968] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.scottspencergfx.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.scottspencergfx.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ailXXvZLFZocvjzWJKrs7QAAAUg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-31 18:40:15
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 14:40:07.553013 2026] [security2:error] [pid 2144:tid 2144] [client 185.221.175.68:41882] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.iee-usa.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.iee-usa.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahyAh8aMXnXQ938y_SzXEgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-31 13:36:41
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 09:36:33.546193 2026] [security2:error] [pid 15188:tid 15188] [client 185.221.175.68:60994] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.eta-mct.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.eta-mct.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahw5YQ3lDj_tEh17RcSkggAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-29 19:57:01
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 15:56:56.092573 2026] [security2:error] [pid 30615:tid 30615] [client 185.221.175.68:33530] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.goodfrequencies.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.goodfrequencies.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahnviBlwWEFBotkpwgrV-wAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-29 13:06:36
(3 weeks ago)
(XMLRPC) WP XMLPRC Attack 185.221.175.68 (IT/Italy/s004.trina.it): 5 in the last 3600 secs; Ports: * ...
show more
(XMLRPC) WP XMLPRC Attack 185.221.175.68 (IT/Italy/s004.trina.it): 5 in the last 3600 secs; Ports: *; Direction: 1
show less
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-05-14 22:31:26
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 18:31:19.502254 2026] [security2:error] [pid 29417:tid 29417] [client 185.221.175.68:55102] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thorndikestudio.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thorndikestudio.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agZNN61pijd5brMpNZdwKwAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-14 18:22:18
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 185.221.175.68 (s004.trina.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 14:22:12.418184 2026] [security2:error] [pid 22630:tid 22630] [client 185.221.175.68:40424] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||arthuryeung.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "arthuryeung.net"] [uri "/wp-json/wp/v2/users"] [unique_id "agYS1FhOY4MgCEyNTbEvKQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob.fr
2026-05-14 18:00:09
(1 month ago)
Repeated 403 errors, blocked by Fail2ban in custom-403 jail
Bad Web Bot
🇺🇸
mnsf
2026-05-14 12:05:25
(1 month ago)
Too many Status 40X (12)
Scanning/Probing (12)
Brute-Force
Web App Attack