🇩🇪
big-cloud.nl
2026-11-13 04:23:29
UTC ·
(2 days ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 16:18:52
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 194.44.50.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 11:18:45.052632 2026] [security2:error] [pid 24791:tid 24791] [client 194.44.50.231:2301] Mo ...
show more
(mod_security) mod_security (id:225170) triggered by 194.44.50.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 11:18:45.052632 2026] [security2:error] [pid 24791:tid 24791] [client 194.44.50.231:2301] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hodlmoser.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hodlmoser.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "avXm5XuSqLhE5VG7uev6mQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-12 05:28:54
UTC ·
(3 days ago)
WordPress attack-tool calls | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36
Web App Attack
Hacking
2026-11-10 05:33:08
UTC ·
(5 days ago)
Pay by Jag firewall blocked WordPress probes from this address against protected websites.
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-11-09 19:34:30
UTC ·
(5 days ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.
Bad Web Bot
Web App Attack
2026-11-09 07:02:23
UTC ·
(6 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-09 00:37:55
UTC ·
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 194.44.50.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 19:37:48.656679 2026] [security2:error] [pid 20795:tid 20795] [client 194.44.50.231:44337] M ...
show more
(mod_security) mod_security (id:225170) triggered by 194.44.50.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 19:37:48.656679 2026] [security2:error] [pid 20795:tid 20795] [client 194.44.50.231:44337] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||math1on1.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "math1on1.net"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avEV3AWBcKHHbz0KWtoatgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 19:08:18
UTC ·
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 194.44.50.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:08:14.739655 2026] [security2:error] [pid 9299:tid 9299] [client 194.44.50.231:1367] ModS ...
show more
(mod_security) mod_security (id:225170) triggered by 194.44.50.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:08:14.739655 2026] [security2:error] [pid 9299:tid 9299] [client 194.44.50.231:1367] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||aimer.es|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aimer.es"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avDInvOFZtTBxXGvOYcH8wAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-05 04:30:25
UTC ·
(1 week ago)
[Thu Nov 05 15:30:24.693156 2026] [security2:error] [pid 468508] [client 194.44.50.231:33008] [client 194.44.50.231] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Thu Nov 05 15:30:24.693156 2026] [security2:error] [pid 468508] [client 194.44.50.231:33008] [client 194.44.50.231] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dance4fitness.com.au"] [uri "/xmlrpc.php"] [unique_id "auwGYApSBtbVvx4bzaWx2QAAAAg"]
...
show less
Web App Attack
🇨🇿
Countryman
2026-11-05 01:10:01
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
computertrendz
2026-11-03 06:40:01
UTC ·
(1 week ago)
Blocked by os-abuseipdb; 7 hits, proto=udp, ports=443
Port Scan
Hacking
🇨🇿
Countryman
2026-11-03 01:10:02
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-11-02 06:31:48
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 194.44.50.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 01:31:42.687873 2026] [security2:error] [pid 668045:tid 668069] [client 194.44.50.231:4301] ...
show more
(mod_security) mod_security (id:225170) triggered by 194.44.50.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 01:31:42.687873 2026] [security2:error] [pid 668045:tid 668069] [client 194.44.50.231:4301] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cynosurelandscapers.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cynosurelandscapers.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "auguThxSd_NrUvAvAvyrAwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-11-01 10:01:07
UTC ·
(2 weeks ago)
Web shell access (POST to a PHP file in wp-includes or wp-content/uploads)
Hacking
Web App Attack
🇨🇿
Countryman
2026-10-31 01:10:01
UTC ·
(2 weeks ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
