🇫🇷
masterguru
2026-11-13 03:07:30
UTC ·
(1 hour ago)
WordPress: User enumeration. Pattern match "(author\\\\= (88030-201)
Hacking
🇳🇱
WeCloudit-Anti-Abuse
2026-11-13 01:46:02
UTC ·
(2 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-12 15:41:07
UTC ·
(12 hours ago)
(mod_security) mod_security (id:225170) triggered by 193.246.148.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 10:41:03.203205 2026] [security2:error] [pid 2405:tid 2405] [client 193.246.148.221:61816] ...
show more
(mod_security) mod_security (id:225170) triggered by 193.246.148.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 10:41:03.203205 2026] [security2:error] [pid 2405:tid 2405] [client 193.246.148.221:61816] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||healingworksmassage.studio|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "healingworksmassage.studio"] [uri "/wp-json/wp/v2/users"] [unique_id "avXeD2KTlQ7FgoIKgltGVQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇹
Malta
2026-11-12 07:40:13
UTC ·
(20 hours ago)
193.246.148.221 - - [12/Nov/2026:08:40:13 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Mobile Safari/537.36"
Brute-force password attempt
Hacking
Web App Attack
Brute-Force
🇺🇸
dtorrer
2026-11-11 07:57:58
UTC ·
(1 day ago)
Brute-force general attack.
Brute-Force
🇫🇷
Tilellit.PRO
2026-11-11 06:59:39
UTC ·
(1 day ago)
WP Armour Plugin detection
Web Spam
Brute-Force
🇺🇸
TPI-Abuse
2026-11-11 02:05:50
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 193.246.148.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 21:05:43.998060 2026] [security2:error] [pid 4030:tid 4030] [client 193.246.148.221:22162] ...
show more
(mod_security) mod_security (id:225170) triggered by 193.246.148.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 21:05:43.998060 2026] [security2:error] [pid 4030:tid 4030] [client 193.246.148.221:22162] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||smoothiessoupssalads.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "smoothiessoupssalads.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avPNd12fkROTOdB2ItwiBQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 07:06:37
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 193.246.148.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 02:06:29.663904 2026] [security2:error] [pid 3447958:tid 3447974] [client 193.246.148.221: ...
show more
(mod_security) mod_security (id:225170) triggered by 193.246.148.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 02:06:29.663904 2026] [security2:error] [pid 3447958:tid 3447974] [client 193.246.148.221:17784] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||quantumgaze.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "quantumgaze.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avLCdXTjnZZbV_9PhPEJLQAAAUw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-10 06:50:13
UTC ·
(2 days ago)
| [Dangerous/Ukraine] Aggressive IP 193.246.148.221 (~30 hits). Type: DoS Defender- Web server 400 error code
Web App Attack
Hacking
SQL Injection
🇩🇪
LRob
2026-11-09 12:47:16
UTC ·
(3 days ago)
WordPress attack-tool calls | method: GET | path: /xmlrpc.php | ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Web App Attack
Hacking
🇫🇷
masterguru
2026-11-07 01:58:41
UTC ·
(6 days ago)
WordPress: User enumeration. Pattern match "(author\\\\= (88030-193)
Hacking
🇺🇸
lostswordfish.com
2026-11-04 16:44:03
UTC ·
(1 week ago)
Wordfence waf block on madesimpleskincare
Web App Attack
🇬🇪
ORDUNET
2026-09-15 10:23:06
UTC ·
(1 month ago)
Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x:8888/udp in AS203136 (LLC Ordunet), Georgia, on 2026-09-15 from 14:17 local time (+04:00). This source sustained more than 800 packets/sec toward a single UDP port, against about 2 ...
show more
Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x:8888/udp in AS203136 (LLC Ordunet), Georgia, on 2026-09-15 from 14:17 local time (+04:00). This source sustained more than 800 packets/sec toward a single UDP port, against about 200 packets/sec for a legitimate player of that server. It was one of 8847 sources in 2396 networks and 160 countries recorded inside a single 25-minute window - the server's entire real audience is about a hundred players. Detected on a MikroTik RouterOS router in the raw/prerouting chain (dst-limit 800,200,src-address/10s); the timestamp is when this source crossed the threshold. Not a scan and not brute force - a packet flood, so the host is most likely compromised. Evidence: [email protected] .
show less
DDoS Attack
Exploited Host
🇺🇸
kosada.com
2026-08-26 19:58:30
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇮🇩
helouism
2026-08-22 17:49:51
UTC ·
(2 months ago)
Fail2Ban: Blocked by UFW for port scanning.
Port Scan
