🇩🇪
thesimonmanuel
2026-11-07 09:05:35
UTC ·
(2 days ago)
200.225.116.225 - - [07/Nov/2026:14:35:34 +0530] "GET /?author=3&_fields=slug HTTP/2.0" 404 1234 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" "-"
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 23:12:20
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 200.225.116.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:12:14.525350 2026] [security2:error] [pid 15018:tid 15018] [client 200.225.116.225:5440 ...
show more
(mod_security) mod_security (id:225170) triggered by 200.225.116.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:12:14.525350 2026] [security2:error] [pid 15018:tid 15018] [client 200.225.116.225:5440] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nearfieldchrist.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nearfieldchrist.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au5ezlJMoV5KF4bCfSlOswAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 11:27:35
UTC ·
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 200.225.116.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 06:27:31.506289 2026] [security2:error] [pid 9483:tid 9483] [client 200.225.116.225:5632] ...
show more
(mod_security) mod_security (id:225170) triggered by 200.225.116.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 06:27:31.506289 2026] [security2:error] [pid 9483:tid 9483] [client 200.225.116.225:5632] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||asapstarsmogcheck.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "asapstarsmogcheck.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au25o4PdbZS-IFvTITs79wAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
lp
2026-11-04 16:33:11
UTC ·
(5 days ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 200.225.116.225
2026-11-04T17:21:46+0100 vpn Access-Reject station: 200.225.116.225
Brute-Force
Web App Attack
🇧🇷
ICS Labs
2026-11-04 14:37:53
UTC ·
(5 days ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-04 UTC.
Brute-Force
🇵🇹
PT
2026-11-04 12:18:12
UTC ·
(5 days ago)
web app attack (botnet)
DDoS Attack
Web App Attack
🇩🇪
LRob
2026-11-03 23:57:09
UTC ·
(5 days ago)
Proxynvader botnet: code forge crawl | path: /Shieldlist/shieldlist-controller/blame/commit/d6c8171f441cb3844b36393e26e5d052287a488a/internal/geoip/geoip.go | src_port: 63635 | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (K ...
show more
Proxynvader botnet: code forge crawl | path: /Shieldlist/shieldlist-controller/blame/commit/d6c8171f441cb3844b36393e26e5d052287a488a/internal/geoip/geoip.go | src_port: 63635 | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
show less
DDoS Attack
Bad Web Bot
🇩🇪
ghostwarriors
2026-11-03 21:50:22
UTC ·
(5 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-03 21:44:44
UTC ·
(5 days ago)
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0 ...
show more
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Sa
Requested, e.g.:
- traefik.[REDACTED]/wp-login.php
show less
Web App Attack
🇫🇷
Tilellit.PRO
2026-11-03 03:39:49
UTC ·
(6 days ago)
Fail2Ban banned 200.225.116.225 for security violations in jail wp-armour. Log: 2026/11/03 03:39:48 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 200.225.116.225 | Type: wplogin | URI: /wp-login.php" , client: 200.225.116.225, ser ...
show more
Fail2Ban banned 200.225.116.225 for security violations in jail wp-armour. Log: 2026/11/03 03:39:48 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 200.225.116.225 | Type: wplogin | URI: /wp-login.php" , client: 200.225.116.225, server: [REDACTED], request: "POST /wp-login.php HTTP/2.0", upstream: [REDACTED], host: [REDACTED], referrer: "https://caffebook.it/wp-login.php"
...
show less
Web Spam
🇨🇿
lp
2026-10-31 12:48:11
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 200.225.116.225
2026-10-31T13:37:34+0100 vpn Access-Reject station: 200.225.116.225
Brute-Force
Web App Attack
🇨🇿
lp
2026-10-31 02:18:05
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 200.225.116.225
2026-10-31T03:11:32+0100 vpn Access-Reject station: 200.225.116.225
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-10-31 01:10:01
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-10-30 22:33:17
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 200.225.116.225
2026-10-30T23:25:20+0100 vpn Access-Reject station: 200.225.116.225
Brute-Force
Web App Attack
🇬🇧
spamverify.com
2026-10-30 22:32:33
UTC ·
(1 week ago)
Honeypot Hit: WordPress Login
Web Spam
Blog Spam
Bad Web Bot
Web App Attack
