🇩🇪
georgengelmann
2026-11-14 00:14:41
UTC ·
(1 day ago)
Failed login attempt for mypindou
Brute-Force
Web App Attack
🇩🇪
LRob
2026-11-12 00:55:42
UTC ·
(3 days ago)
WordPress attack-tool calls | method: POST | path: /xmlrpc.php | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15 | 2026-11-12 00:55 UTC
Web App Attack
Hacking
🇩🇪
FeG Deutschland
2026-11-10 22:52:04
UTC ·
(4 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 11:39:59
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 190.4.127.53 (190-4-127-53.interfacenet.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:39:53.669106 2026] [security2:error] [pid 31947:tid 31947] [cli ...
show more
(mod_security) mod_security (id:225170) triggered by 190.4.127.53 (190-4-127-53.interfacenet.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:39:53.669106 2026] [security2:error] [pid 31947:tid 31947] [client 190.4.127.53:42562] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rkhindustries.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rkhindustries.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avMCiak5tvhg8x5-NMeBBQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 11:17:53
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 190.4.127.53 (190-4-127-53.interfacenet.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:17:44.785833 2026] [security2:error] [pid 31141:tid 31141] [cli ...
show more
(mod_security) mod_security (id:225170) triggered by 190.4.127.53 (190-4-127-53.interfacenet.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:17:44.785833 2026] [security2:error] [pid 31141:tid 31141] [client 190.4.127.53:38380] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||saynotoofland.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "saynotoofland.org"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "avL9WBeAEtBPzdrtIKY7tAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 06:21:07
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 190.4.127.53 (190-4-127-53.interfacenet.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 01:21:01.250681 2026] [security2:error] [pid 18719:tid 18817] [cli ...
show more
(mod_security) mod_security (id:225170) triggered by 190.4.127.53 (190-4-127-53.interfacenet.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 01:21:01.250681 2026] [security2:error] [pid 18719:tid 18817] [client 190.4.127.53:57020] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mail.kennedyfineartphotography.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mail.kennedyfineartphotography.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au1xzVgPrf-buXC8CD97DgAAAdg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-05 11:22:47
UTC ·
(1 week ago)
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0 | 2026-11-05 11:22 UTC
Bad Web Bot
🇺🇸
dtorrer
2026-11-05 11:22:22
UTC ·
(1 week ago)
Brute-force general attack.
Brute-Force
🇨🇿
Countryman
2026-11-05 01:10:01
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
lostswordfish.com
2026-11-04 20:44:04
UTC ·
(1 week ago)
Wordfence waf block on registrymatters
Web App Attack
🇨🇿
Countryman
2026-11-04 01:10:06
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇭
SOC [GOLINE SA]
2026-11-03 20:26:14
UTC ·
(1 week ago)
[RoutePulse | 2026-11-03T20:26:14Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 190.4.127.53
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — slow spray: 3 failed logins over 2 h (one every ~59 min, u ...
show more
[RoutePulse | 2026-11-03T20:26:14Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 190.4.127.53
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — slow spray: 3 failed logins over 2 h (one every ~59 min, under every 15-min threshold and the FTD hold-down) — rung 1-bis (doc 247 §10.2)
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
Brute-Force
Hacking
🇨🇿
lp
2026-11-03 11:48:22
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 190.4.127.53
2026-11-03T12:32:43+0100 vpn Access-Reject station: 190.4.127.53
Brute-Force
Web App Attack
🇨🇿
lp
2026-10-31 13:32:56
UTC ·
(2 weeks ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 190.4.127.53
2026-10-31T14:25:22+0100 vpn Access-Reject station: 190.4.127.53
Brute-Force
Web App Attack
🇮🇹
LTM
2026-10-30 07:20:01
UTC ·
(2 weeks ago)
WebServer - Attempts to exploit
Hacking
Brute-Force
Web App Attack
