🇪🇸
librebit
2026-09-29 13:45:14
(4 hours ago)
Brute force
Brute-Force
🇳🇱
WeCloudit-Anti-Abuse
2026-07-14 13:40:55
(2 months ago)
HTTP flood against /retreat-corp on Apache webserver
Brute-Force
🇺🇸
TPI-Abuse
2026-05-12 00:00:13
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.223.91 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.223.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 20:00:04.133992 2026] [security2:error] [pid 30847:tid 30847] [client 185.61.223.91:20541] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||neconebooks.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "neconebooks.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agJthCJxqaJAhX17fVTmFAAAAA8"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-03-26 20:10:59
(6 months ago)
Detected attack and reported by a human
Brute-Force
Web App Attack
SSH
DDoS Attack
Exploited Host
Bad Web Bot
🇺🇸
TPI-Abuse
2026-02-01 03:37:56
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.223.91 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.223.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 31 22:37:51.135389 2026] [security2:error] [pid 26315:tid 26315] [client 185.61.223.91:57499] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||tausiet.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tausiet.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aX7Kjwr_U6TVlFK0IVp9BQAAAAA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Swiptly
2023-12-20 02:26:14
(2 years ago)
WordPress brute force login or enumeration
...
Web Spam
Bad Web Bot
Web App Attack
🇦🇺
MAGIC
2023-12-19 10:07:23
(2 years ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2023-12-14 00:35:18
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 185.61.223.91 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.223.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 13 19:35:10.815869 2023] [security2:error] [pid 23377] [client 185.61.223.91:52519] [client 185.61.223.91] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||beesuniverse.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "beesuniverse.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ZXpNvrARXrHhOrphcZtaXwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
corthorn
2023-12-12 21:55:14
(2 years ago)
185.61.223.91 - - [12/Dec/2023:22:55:13 +0100] "POST /wp-login.php HTTP/1.1" 200 8249 "https://koan. ...
show more
185.61.223.91 - - [12/Dec/2023:22:55:13 +0100] "POST /wp-login.php HTTP/1.1" 200 8249 "https://koan.al/wp-login.php" "Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/93.0.4577.62 Mobile DuckDuckGo/5 Safari/537.36"
...
show less
Brute-Force
2023-12-11 10:54:02
(2 years ago)
Bot / scanning and/or hacking attempts: POST /wp-login.php HTTP/1.1
Hacking
Web App Attack
🇩🇪
georgengelmann
2023-12-06 17:17:57
(2 years ago)
Failed login attempt for superuser
Brute-Force
Web App Attack
🇦🇺
MAGIC
2023-12-02 13:06:44
(2 years ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
2023-12-02 09:37:51
(2 years ago)
geburtshaus-fulda.de 185.61.223.91 [02/Dec/2023:10:37:49 +0100] "POST /wp-login.php HTTP/1.1" 200 90 ...
show more
geburtshaus-fulda.de 185.61.223.91 [02/Dec/2023:10:37:49 +0100] "POST /wp-login.php HTTP/1.1" 200 9009 "https://geburtshaus-fulda.de/wp-login.php" "Mozilla/5.0 (Linux; Android 12) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/97.0.4692.98 Mobile DuckDuckGo/5 Safari/537.36"
geburtshaus-fulda.de 185.61.223.91 [02/Dec/2023:10:37:50 +0100] "POST /wp-login.php HTTP/1.1" 200 9009 "https://geburtshaus-fulda.de/wp-login.php" "Mozilla/5.0 (iPhone; CPU iPhone OS 15_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/97.0.4692.84 Mobile/15E148 Safari/604.1"
show less
Web App Attack
🇺🇸
TPI-Abuse
2023-11-30 11:25:54
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 185.61.223.91 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.223.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 30 06:25:47.769438 2023] [security2:error] [pid 28601] [client 185.61.223.91:46909] [client 185.61.223.91] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||arriagarealestate.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "arriagarealestate.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ZWhxOxbvAMmKaxUnY7ekzAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇸
Smel
2021-04-30 10:52:52
(5 years ago)
Mail/25/465/587-993/995 Probe, Reject, BadAuth, Hack, SPAM -
Email Spam
Hacking
Brute-Force
