🇺🇸
TPI-Abuse
2026-10-26 13:22:40
(8 hours ago)
(mod_security) mod_security (id:225170) triggered by 190.161.139.190 (pc-190-139-161-190.cm.vtr.net) ...
show more
(mod_security) mod_security (id:225170) triggered by 190.161.139.190 (pc-190-139-161-190.cm.vtr.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 09:22:35.480748 2026] [security2:error] [pid 5558:tid 5558] [client 190.161.139.190:37390] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||axiomemail.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "axiomemail.net"] [uri "/wp-json/wp/v2/users/me"] [unique_id "at9UG8mBIP79feQlvnNcoQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mawan
2026-10-25 02:46:23
(1 day ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 12:08:28
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 190.161.139.190 (pc-190-139-161-190.cm.vtr.net) ...
show more
(mod_security) mod_security (id:225170) triggered by 190.161.139.190 (pc-190-139-161-190.cm.vtr.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 08:08:21.759280 2026] [security2:error] [pid 31245:tid 31245] [client 190.161.139.190:59668] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||michaelthompson.biz|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "michaelthompson.biz"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atyftfex7KRPRASYMfrfzwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 08:14:32
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 190.161.139.190 (pc-190-139-161-190.cm.vtr.net) ...
show more
(mod_security) mod_security (id:225170) triggered by 190.161.139.190 (pc-190-139-161-190.cm.vtr.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 04:14:23.747435 2026] [security2:error] [pid 3127:tid 3127] [client 190.161.139.190:55986] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||speedgo.mx|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "speedgo.mx"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "atxo3-M0Y55jeEoKnYeclwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 20:31:40
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 190.161.139.190 (pc-190-139-161-190.cm.vtr.net) ...
show more
(mod_security) mod_security (id:225170) triggered by 190.161.139.190 (pc-190-139-161-190.cm.vtr.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 16:31:34.098269 2026] [security2:error] [pid 25139:tid 25228] [client 190.161.139.190:47352] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||metropaint.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "metropaint.net"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atfPpvV4f8iM3AhIp6MQjQAAAUQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-20 11:37:34
(6 days ago)
POST /xmlrpc.php HTTP/1.1
...
Brute-Force
🇲🇽
octageeks.com
2026-10-20 04:07:41
(6 days ago)
Wordpress malicious attack:[octaflood]
Web App Attack
🇲🇹
Malta
2026-10-20 00:38:39
(6 days ago)
190.161.139.190 - - [20/Oct/2026:02:38:39 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows ...
show more
190.161.139.190 - - [20/Oct/2026:02:38:39 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
Brute-force password attempt
show less
Hacking
Web App Attack
Brute-Force
🇩🇪
big-cloud.nl
2026-10-18 17:18:37
(1 week ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 11:33:53
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 190.161.139.190 (pc-190-139-161-190.cm.vtr.net) ...
show more
(mod_security) mod_security (id:225170) triggered by 190.161.139.190 (pc-190-139-161-190.cm.vtr.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 07:33:45.788737 2026] [security2:error] [pid 31888:tid 31888] [client 190.161.139.190:52270] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||arogun.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "arogun.org"] [uri "/wp-json/wp/v2/users"] [unique_id "atNdGUFyKom7OosOQeM4ngAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-10-17 03:48:07
(1 week ago)
Fail2Ban banned 190.161.139.190 for security violations in jail wp-armour. Log: 2026/10/17 03:48:07 ...
show more
Fail2Ban banned 190.161.139.190 for security violations in jail wp-armour. Log: 2026/10/17 03:48:07 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 190.161.139.190 | Type: wplogin | URI: /wp-login.php" , client: 190.161.139.190, server: [REDACTED], request: "POST /wp-login.php HTTP/2.0", upstream: [REDACTED], host: [REDACTED], referrer: "https://caffebook.it/wp-login.php"
...
show less
Web Spam
🇺🇸
TPI-Abuse
2026-10-14 22:43:39
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 190.161.139.190 (pc-190-139-161-190.cm.vtr.net) ...
show more
(mod_security) mod_security (id:225170) triggered by 190.161.139.190 (pc-190-139-161-190.cm.vtr.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 18:43:32.216451 2026] [security2:error] [pid 21440:tid 21440] [client 190.161.139.190:40392] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nwtree.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nwtree.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atAFlBexk9ItLWmvXGp9GwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
