🇸🇪
vaia.cloud
2026-11-10 07:55:02
UTC ·
(2 hours ago)
crowdsecurity/http-cve-probing
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 06:07:19
UTC ·
(3 hours ago)
(mod_security) mod_security (id:225170) triggered by 201.33.77.20 (201-33-77-20.customer.nbtos.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 01:07:11.842891 2026] [security2:error] [pid 15275:tid 15275 ...
show more
(mod_security) mod_security (id:225170) triggered by 201.33.77.20 (201-33-77-20.customer.nbtos.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 01:07:11.842891 2026] [security2:error] [pid 15275:tid 15275] [client 201.33.77.20:59722] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||sizefinder.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sizefinder.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avK0jy9U-GzNwT2FJDyjAAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Hazzard
2026-11-09 21:37:57
UTC ·
(12 hours ago)
(wordpress) Failed wordpress login from 201.33.77.20 (BR/Brazil/São Paulo/Barretos/201-33-77-20.customer.nbtos.com.br/[redacted]): (CF_ENABLE)
Brute-Force
🇵🇱
Budyn
2026-11-09 10:04:02
UTC ·
(23 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: docker.astropot.tech | Path: /wp-admin/ | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb ...
show more
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: docker.astropot.tech | Path: /wp-admin/ | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-08 13:01:01
UTC ·
(1 day ago)
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/155.0.8059.37 Mobile/15E
Bad Web Bot
🇩🇪
london2038.com
2026-11-07 02:22:30
UTC ·
(3 days ago)
Probing for exploits
201.33.77.20 - - [07/Nov/2026:03:22:25 +0100] "GET /wp-json/wp/v2/comments?per_page=100&page=1&_fields=author_name,author_url HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) C ...
show more
Probing for exploits
201.33.77.20 - - [07/Nov/2026:03:22:25 +0100] "GET /wp-json/wp/v2/comments?per_page=100&page=1&_fields=author_name,author_url HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
201.33.77.20 - - [07/Nov/2026:03:22:27 +0100] "GET /wp-json/wp/v2/users?per_page=100&_fields=id,slug&per_page=100&page=1 HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
show less
Hacking
Web App Attack
2026-11-06 10:46:31
UTC ·
(3 days ago)
Apache vulnerability scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 08:28:39
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 201.33.77.20 (201-33-77-20.customer.nbtos.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 03:28:32.087088 2026] [security2:error] [pid 11104:tid 11104 ...
show more
(mod_security) mod_security (id:225170) triggered by 201.33.77.20 (201-33-77-20.customer.nbtos.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 03:28:32.087088 2026] [security2:error] [pid 11104:tid 11104] [client 201.33.77.20:60045] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||learnserve.cyberclay.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "learnserve.cyberclay.net"] [uri "/wp-json/wp/v2/users"] [unique_id "au2PsNOZOOOPqPEylJ1xCgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-11-06 01:10:01
UTC ·
(4 days ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
lostswordfish.com
2026-11-04 21:46:03
UTC ·
(5 days ago)
Wordfence waf block on parsol
Web App Attack
