🇺🇸
TPI-Abuse
2026-06-18 22:39:09
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 195.54.179.151 (s4.proserv.ge): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 195.54.179.151 (s4.proserv.ge): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 18:39:03.463525 2026] [security2:error] [pid 27502:tid 27502] [client 195.54.179.151:45090] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||alpha-hk.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "alpha-hk.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ajRzh15qj2t8RhabSOf4YQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 22:55:59
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 195.54.179.151 (s4.proserv.ge): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 195.54.179.151 (s4.proserv.ge): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 18:55:53.079181 2026] [security2:error] [pid 29631:tid 29631] [client 195.54.179.151:36366] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||oruhu.org.circulodesonido.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "oruhu.org.circulodesonido.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ajCC-QqUOvJ4wNy8iEm48QAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 15:38:31
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 195.54.179.151 (s4.proserv.ge): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 195.54.179.151 (s4.proserv.ge): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 11:38:23.337363 2026] [security2:error] [pid 22473:tid 22473] [client 195.54.179.151:44662] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||arsenalfordemocracy.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ai15b0bXflx7-m9NgA2hsAAAAGA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-06-12 12:51:22
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
xxkodedxx
2026-06-09 07:26:18
(2 weeks ago)
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get in 10m window.
...
show more
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get in 10m window.
Active: 07:25:18→07:25:19 UTC
Volume: 2 honeypot probe(s)
Bait taken: /wp-login.php
Vhost fishing: cards.zvxlabs.com
UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 05:31:54
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 195.54.179.151 (s4.proserv.ge): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 195.54.179.151 (s4.proserv.ge): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 01:31:49.769704 2026] [security2:error] [pid 30614:tid 30614] [client 195.54.179.151:49564] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||josephshv.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "josephshv.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aiZTxQSCk44gxD1tEoC98gAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇹
Malta
2026-06-07 18:24:39
(2 weeks ago)
195.54.179.151 - - [07/Jun/2026:20:24:39 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintos ...
show more
195.54.179.151 - - [07/Jun/2026:20:24:39 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
show less
Hacking
Web App Attack
🇩🇪
FeG Deutschland
2026-06-07 11:59:33
(2 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇫🇷
ELYAZ
2026-06-05 14:47:02
(2 weeks ago)
(wordpress) Failed wordpress login from 195.54.179.151 (GE/Georgia/s4.proserv.ge): (CF_ENABLE)
Brute-Force
🇺🇸
TPI-Abuse
2026-06-05 07:55:44
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 195.54.179.151 (s4.proserv.ge): 1 in the last 3 ...
show more
(mod_security) mod_security (id:225170) triggered by 195.54.179.151 (s4.proserv.ge): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 03:55:36.212637 2026] [security2:error] [pid 21555:tid 21555] [client 195.54.179.151:40804] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rwabutazafoundation.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rwabutazafoundation.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aiKA-EONsZ1E-R3UTAMTLQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇽
octageeks.com
2026-06-04 04:09:33
(2 weeks ago)
Wordpress malicious attack:[octawpauthor]
Web App Attack
🇫🇷
masterguru
2026-06-02 10:11:54
(2 weeks ago)
(modsec_5040) ModSec 5040: API Basic Auth blocked from 195.54.179.151 (GE/Georgia/s4.proserv.ge): 1 ...
show more
(modsec_5040) ModSec 5040: API Basic Auth blocked from 195.54.179.151 (GE/Georgia/s4.proserv.ge): 1 in the last 3600 secs (0-197)
show less
Hacking
🇫🇷
masterguru
2026-05-31 14:00:17
(3 weeks ago)
(modsec_5040) ModSec 5040: API Basic Auth blocked from 195.54.179.151 (GE/Georgia/s4.proserv.ge): 1 ...
show more
(modsec_5040) ModSec 5040: API Basic Auth blocked from 195.54.179.151 (GE/Georgia/s4.proserv.ge): 1 in the last 3600 secs (0-197)
show less
Hacking
🇩🇪
FeG Deutschland
2026-05-30 11:50:54
(3 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇲🇹
Malta
2026-05-30 04:41:39
(3 weeks ago)
195.54.179.151 - - [30/May/2026:06:41:39 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintos ...
show more
195.54.179.151 - - [30/May/2026:06:41:39 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
show less
Hacking
Web App Attack