Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
(wordpress) Failed wordpress login from 201.15.147.234 (BR/Brazil/Rio Grande do Sul/Porto Alegre/201-15-147-234.user3p.v-tal.net.br/[redacted]): (CF_ENABLE)
(mod_security) mod_security (id:225170) triggered by 201.15.147.234 (201-15-147-234.user3p.v-tal.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:39:22.419044 2026] [security2:error] [pid 24233:tid 242 ...
show more(mod_security) mod_security (id:225170) triggered by 201.15.147.234 (201-15-147-234.user3p.v-tal.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:39:22.419044 2026] [security2:error] [pid 24233:tid 24233] [client 201.15.147.234:50706] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ekur-art.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ekur-art.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avZ4WjSKihi3X4G0_b5BBwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
Web attack blocked by WAF.
Web App Attack
Anonymous
Web attack blocked by WAF: GET /wp-json/wp/v2/users x2, GET /wp-json/batch/v1/users (Monitoring WordPress 5.3 User Enumeration attempts; Possible WordPress Dashboard access for infectors).
[12/Nov/2026:20:44:17 +0300] "GET /wp-json/wp/v2/users?per_pa ...
show moreWeb attack blocked by WAF: GET /wp-json/wp/v2/users x2, GET /wp-json/batch/v1/users (Monitoring WordPress 5.3 User Enumeration attempts; Possible WordPress Dashboard access for infectors).
[12/Nov/2026:20:44:17 +0300] "GET /wp-json/wp/v2/users?per_page=100&_fields=id,slug&per_page=100&page=1 HTTP/1.1" UA="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/15" -> Monitoring WordPress 5.3 User Enumeration attempts; Poss…
[12/Nov/2026:20:44:32 +0300] "GET /wp-json/batch/v1/users?per_page=100 HTTP/1.1" UA="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/15" -> [monitor] /wp-json/ REST namespace enumeration (WPT-2744)
[12/Nov/2026:20:44:35 +0300] "GET /wp-json/wp/v2/users?per_page=50&_embed&_fields=id,slug,name HTTP/1.1" UA="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/15" -> Monitoring WordPress 5.3 User Enumeration attempts; Possible Word…
show less
Web App Attack
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown
