🇩🇪
FeG Deutschland
2026-05-20 21:37:04
(2 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇦🇺
paulshipley.com.au
2026-05-20 21:01:05
(2 weeks ago)
levellapromotions.com.au:443 192.250.239.252 - - [21/May/2026:07:01:02 +1000] "GET /?author=1 HTTP/1 ...
show more
levellapromotions.com.au:443 192.250.239.252 - - [21/May/2026:07:01:02 +1000] "GET /?author=1 HTTP/1.1" 404 347992 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36, Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇩🇪
LRob.fr
2026-05-20 21:00:12
(2 weeks ago)
Repeated attacks detected by Fail2Ban in recidive jail
Hacking
🇺🇸
omc
2026-05-20 20:56:50
(2 weeks ago)
Blacklisted client denied access [PP]
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-20 20:45:31
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 192.250.239.252 (d6110.lon1.stableserver.net): ...
show more
(mod_security) mod_security (id:225170) triggered by 192.250.239.252 (d6110.lon1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 16:45:23.954191 2026] [security2:error] [pid 23298:tid 23298] [client 192.250.239.252:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nextmoon.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nextmoon.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag4dY7WicvGQqmgSU-dycgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Vianpyro
2026-05-20 20:19:51
(2 weeks ago)
Honeypot: 10 request(s) in 1532 min. Paths: /wp-json/webmention/1.0, /sitemap_index.xml, /wp-json/, ...
show more
Honeypot: 10 request(s) in 1532 min. Paths: /wp-json/webmention/1.0, /sitemap_index.xml, /wp-json/, /, /wp-json/ldlms/v2/users. Method(s): POST,GET. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). ASN: 51713 (WHG Hosting Services Ltd).
show less
Web App Attack
Bad Web Bot
Brute-Force
Hacking
2026-05-20 20:15:16
(2 weeks ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇦🇺
paulshipley.com.au
2026-05-20 19:38:47
(2 weeks ago)
levellapromotions.com.au:443 192.250.239.252 - - [21/May/2026:05:38:44 +1000] "GET /?author=14 HTTP/ ...
show more
levellapromotions.com.au:443 192.250.239.252 - - [21/May/2026:05:38:44 +1000] "GET /?author=14 HTTP/1.1" 404 347994 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36, Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0"
...
show less
Web App Attack
🇺🇸
CollideTech
2026-05-20 18:42:03
(2 weeks ago)
probing for vulnerabilities
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 18:41:47
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 192.250.239.252 (d6110.lon1.stableserver.net): ...
show more
(mod_security) mod_security (id:225170) triggered by 192.250.239.252 (d6110.lon1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 14:41:39.807596 2026] [security2:error] [pid 25540:tid 25540] [client 192.250.239.252:43096] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||celltechs.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "celltechs.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ag4AY8X2XAs-3fN5fMiZ8AAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-05-20 18:06:30
(2 weeks ago)
Probing websites for vulnerabilities
Web App Attack
SQL Injection
2026-05-20 16:32:51
(2 weeks ago)
wordpress authentication brute force
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 16:25:33
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 192.250.239.252 (d6110.lon1.stableserver.net): ...
show more
(mod_security) mod_security (id:225170) triggered by 192.250.239.252 (d6110.lon1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 12:25:28.934054 2026] [security2:error] [pid 13325:tid 13325] [client 192.250.239.252:43920] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||decisiontrace.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "decisiontrace.org"] [uri "/wp-json/wp/v2/users"] [unique_id "ag3geNilr8RdHKFF_HPOrQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
ELYAZ
2026-05-20 16:03:35
(2 weeks ago)
(y3) Failed access -byebye- from 192.250.239.252 (GB/United Kingdom/d6110.lon1.stableserver.net): ( ...
show more
(y3) Failed access -byebye- from 192.250.239.252 (GB/United Kingdom/d6110.lon1.stableserver.net): (CF_ENABLE)
show less
Hacking
🇩🇪
LRob.fr
2026-05-20 14:00:13
(2 weeks ago)
Repeated 403 errors, blocked by Fail2ban in custom-403 jail
Bad Web Bot