🇩🇪
Hazzard
2026-11-13 08:04:47
UTC ·
(6 hours ago)
(wordpress) Failed wordpress login from 200.165.120.158 (BR/Brazil/Espírito Santo/Vitória/200-165-120-158.user3p.vtal.net.br/[redacted]): (CF_ENABLE)
Brute-Force
🇺🇸
TPI-Abuse
2026-11-12 19:07:39
UTC ·
(19 hours ago)
(mod_security) mod_security (id:225170) triggered by 200.165.120.158 (200-165-120-158.user3p.vtal.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 14:07:30.330314 2026] [security2:error] [pid 11130:tid 11 ...
show more
(mod_security) mod_security (id:225170) triggered by 200.165.120.158 (200-165-120-158.user3p.vtal.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 14:07:30.330314 2026] [security2:error] [pid 11130:tid 11191] [client 200.165.120.158:33431] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||tsdlivesearch.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tsdlivesearch.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avYOclhwDimUa5BYQUcrogAAANg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-12 14:28:19
UTC ·
(23 hours ago)
200.165.120.158 - - [12/Nov/2026:16:28:08 +0200] "GET /wp-json/wp/v2/users?per_page=100&_fields=id,slug&per_page=100&page=1 HTTP/1.1" 404 185 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
...
show more
200.165.120.158 - - [12/Nov/2026:16:28:08 +0200] "GET /wp-json/wp/v2/users?per_page=100&_fields=id,slug&per_page=100&page=1 HTTP/1.1" 404 185 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
200.165.120.158 - - [12/Nov/2026:16:28:08 +0200] "GET /author-sitemap.xml HTTP/1.1" 404 185 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
200.165.120.158 - - [12/Nov/2026:16:28:09 +0200] "GET /author-sitemap.xml HTTP/1.1" 404 185 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
200.165.120.158 - - [12/Nov/2026:16:28:09 +0200] "GET /sitemap_index.xml HTTP/1.1" 404 185 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
200.165.120.158 - - [12/Nov/2026:16:28:10 +0200] "GET /wp-sitemap-users-1.xml HTTP/1.1" 404 185 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
...
show less
Bad Web Bot
Web App Attack
🇫🇷
SLBCLOUD
2026-11-12 00:18:00
UTC ·
(1 day ago)
DDoS: UDP flood to port 30205, peak 21.49 Mbps / 1.9 kpps (60s avg), 2026-11-12 00:18-00:19 UTC, observed by AS215114 SLBCLOUD (sampled flow data).
DDoS Attack
2026-11-10 07:40:06
UTC ·
(3 days ago)
| [Dangerous/Brazil] Aggressive IP 200.165.120.158 (~30 hits). Type: DoS Defender- Web server 400 error code
Web App Attack
Hacking
SQL Injection
🇩🇪
tentwentyfour
2026-11-10 01:35:58
UTC ·
(3 days ago)
Blocked for brute-forcing WordPress log-in
Brute-Force
Web App Attack
🇺🇸
justbible
2026-11-07 23:50:40
UTC ·
(5 days ago)
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 2 requests from 2026-11-07T23:50:40+00:00 to 2026-11-08T06:29:33+00:00, e.g. 'GET /en/kjv,bbe/mic/1/4 HTTP/2.0' with User-Agent 'Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gec ...
show more
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 2 requests from 2026-11-07T23:50:40+00:00 to 2026-11-08T06:29:33+00:00, e.g. 'GET /en/kjv,bbe/mic/1/4 HTTP/2.0' with User-Agent 'Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested).
show less
Bad Web Bot
🇩🇪
big-cloud.nl
2026-11-07 12:23:36
UTC ·
(6 days ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 00:29:27
UTC ·
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 200.165.120.158 (200-165-120-158.user3p.vtal.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 19:29:23.141767 2026] [security2:error] [pid 7024:tid 702 ...
show more
(mod_security) mod_security (id:225170) triggered by 200.165.120.158 (200-165-120-158.user3p.vtal.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 19:29:23.141767 2026] [security2:error] [pid 7024:tid 7024] [client 200.165.120.158:35444] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||daebakdesign.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "daebakdesign.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "au5w40Zn66GVXwallBDxSgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 08:06:07
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 200.165.120.158 (200-165-120-158.user3p.vtal.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 03:06:00.750128 2026] [security2:error] [pid 20103:tid 20 ...
show more
(mod_security) mod_security (id:225170) triggered by 200.165.120.158 (200-165-120-158.user3p.vtal.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 03:06:00.750128 2026] [security2:error] [pid 20103:tid 20218] [client 200.165.120.158:33846] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||koliosfoods.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "koliosfoods.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "au2KaCHMvGECtBt6fHYvGQAAAVI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-06 07:07:05
UTC ·
(1 week ago)
Web exploit attempt | method: GET | path: /wp-json/wp/v2/users | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Hacking
Web App Attack
🇲🇽
octageeks.com
2026-11-05 05:24:46
UTC ·
(1 week ago)
Wordpress malicious attack:[octaflood]
Web App Attack
🇮🇩
IndoAbuse
2026-11-04 18:34:16
UTC ·
(1 week ago)
WordPress brute-force attack detected on wp-login.php / xmlrpc.php. IP automatically banned.
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-11-04 01:10:06
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇲🇽
octageeks.com
2026-11-03 05:35:38
UTC ·
(1 week ago)
Wordpress malicious attack:[octaflood]
Web App Attack
