🇺🇸
TPI-Abuse
2026-11-06 23:58:15
UTC ·
(4 hours ago)
(mod_security) mod_security (id:225170) triggered by 189.152.11.122 (dsl-122-11-152-189-dynamic.prod-infinitum.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:58:11.481518 2026] [security2:error] [pid ...
show more
(mod_security) mod_security (id:225170) triggered by 189.152.11.122 (dsl-122-11-152-189-dynamic.prod-infinitum.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:58:11.481518 2026] [security2:error] [pid 17058:tid 17104] [client 189.152.11.122:52752] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gryphix2014.thesdgriffingroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gryphix2014.thesdgriffingroup.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "au5pk-CrilH9yam-3z_4jwAAAco"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-06 21:50:39
UTC ·
(6 hours ago)
Wordlist path sweep | method: GET | path: /wp-json/wemail/v1/subscribers, /wp-json/wc/v2/customers, /wp-json/wp/v2/users/me | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 | 2026-1 ...
show more
Wordlist path sweep | method: GET | path: /wp-json/wemail/v1/subscribers, /wp-json/wc/v2/customers, /wp-json/wp/v2/users/me | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 | 2026-11-06 21:50 UTC
show less
Port Scan
Web App Attack
2026-11-06 18:42:56
UTC ·
(10 hours ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇬🇧
Comberton
2026-11-06 09:44:46
UTC ·
(18 hours ago)
Ban via F2B web files probes
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 06:28:05
UTC ·
(22 hours ago)
(mod_security) mod_security (id:225170) triggered by 189.152.11.122 (dsl-122-11-152-189-dynamic.prod-infinitum.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 01:27:57.568557 2026] [security2:error] [pid ...
show more
(mod_security) mod_security (id:225170) triggered by 189.152.11.122 (dsl-122-11-152-189-dynamic.prod-infinitum.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 01:27:57.568557 2026] [security2:error] [pid 26941:tid 26941] [client 189.152.11.122:43068] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||pearlhomesfw.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "pearlhomesfw.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au1zbcbZwApS9dTr6lKWKgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-06 01:43:51
UTC ·
(1 day ago)
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 | src_port: 53560
Bad Web Bot
🇨🇿
Countryman
2026-11-06 01:10:01
UTC ·
(1 day ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇪🇸
pipeline.es
2026-11-05 13:31:23
UTC ·
(1 day ago)
WordPress login brute-force | URL: https://gacetadelturismo.com/xmlrpc.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-05T13:29:56Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\"18 ...
show more
WordPress login brute-force | URL: https://gacetadelturismo.com/xmlrpc.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-05T13:29:56Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\"189.152.11.122\",\"status_code\":503,\"url\":\"https://gacetadelturismo.com/xmlrpc.php\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0\",\"wfid\":4748600} | ASN: UNINET | Country: MX
show less
Brute-Force
🇨🇿
lp
2026-11-05 05:32:56
UTC ·
(1 day ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 189.152.11.122
2026-11-05T06:17:05+0100 vpn Access-Reject station: 189.152.11.122
Brute-Force
Web App Attack
🇨🇿
lp
2026-11-04 13:33:13
UTC ·
(2 days ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 189.152.11.122
2026-11-04T14:19:08+0100 vpn Access-Reject station: 189.152.11.122
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 12:39:21
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 189.152.11.122 (dsl-122-11-152-189-dynamic.prod-infinitum.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 07:39:16.052516 2026] [security2:error] [pid ...
show more
(mod_security) mod_security (id:225170) triggered by 189.152.11.122 (dsl-122-11-152-189-dynamic.prod-infinitum.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 07:39:16.052516 2026] [security2:error] [pid 26961:tid 26961] [client 189.152.11.122:60942] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||opticasprisma.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "opticasprisma.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ausndLW4TnKvaRB5WkisVgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 08:23:41
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 189.152.11.122 (dsl-122-11-152-189-dynamic.prod-infinitum.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 03:23:34.598490 2026] [security2:error] [pid ...
show more
(mod_security) mod_security (id:225170) triggered by 189.152.11.122 (dsl-122-11-152-189-dynamic.prod-infinitum.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 03:23:34.598490 2026] [security2:error] [pid 17969:tid 17969] [client 189.152.11.122:60162] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mail.sherinemec-wies.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mail.sherinemec-wies.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aurrhjZlioMPg5okjr_JOQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
OK
2026-11-04 02:39:04
UTC ·
(3 days ago)
HTTP/HTTPS
Hacking
Web App Attack
