🇺🇸
1cyb3rpunk
2026-11-09 23:54:45
UTC ·
(1 day ago)
Coordinated campaign CMP-1786835248-000: 3482 IPs sharing an attack fingerprint (acme_challenge_probe, admin_panel_probe, asset_directory_probe, attacker_objective_inferred, automation_creds_submission, aws_creds_file_probe). Observed on sectrace.org ...
show more
Coordinated campaign CMP-1786835248-000: 3482 IPs sharing an attack fingerprint (acme_challenge_probe, admin_panel_probe, asset_directory_probe, attacker_objective_inferred, automation_creds_submission, aws_creds_file_probe). Observed on sectrace.org honeypot surface.
show less
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-11-06 17:44:45
UTC ·
(4 days ago)
Probing websites for vulnerabilities
Web App Attack
🇳🇱
Alt255
2026-11-06 17:23:30
UTC ·
(4 days ago)
[ti-24al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 201.79.97.215 - - [06/Nov/2026:18:21:23 +0100] "POST /xmlrpc.php HTTP/1.1" 403 8007 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple ...
show more
[ti-24al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 201.79.97.215 - - [06/Nov/2026:18:21:23 +0100] "POST /xmlrpc.php HTTP/1.1" 403 8007 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.2210.133"
201.79.97.215 - - [06/Nov/2026:18:22:27 +0100] "POST /wp-login.php HTTP/1.1" 503 19815 "https://www.bruns-broekhuis.nl/wp-admin/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6.1 Safari/605.1.15"
201.79.97.215 - - [06/Nov/2026:18:23:16 +0100] "POST /xmlrpc.php HTTP/1.1" 404 17138 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:120.0.1) Gecko/20100101 Firefox/120.0.1"
201.79.97.215 - - [06/Nov/2026:18:23:16 +0100] "POS
...
show less
Brute-Force
Web App Attack
🇧🇷
radardatelecom
2026-11-06 16:54:03
UTC ·
(4 days ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇫🇮
YF
2026-11-06 16:00:42
UTC ·
(4 days ago)
WordPress author enumeration
Web App Attack
🇫🇷
Ehvox
2026-11-06 10:27:57
UTC ·
(4 days ago)
BunkerWeb WAF detection: 201.79.97.215 - GET /license.txt HTTP/1.1,
Reason: country - {"country":"SG","id":"country"}
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 22:09:29
UTC ·
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 2002:c94f:61d7::c94f:61d7 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 17:09:19.806633 2026] [security2:error] [pid 17291:tid 17291] [client 2002 ...
show more
(mod_security) mod_security (id:225170) triggered by 2002:c94f:61d7::c94f:61d7 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 17:09:19.806633 2026] [security2:error] [pid 17291:tid 17291] [client 2002:c94f:61d7::c94f:61d7:60850] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||pistonsociety.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "pistonsociety.com"] [uri "/wp-json/wp/v2/users"] [unique_id "auz-j4HROd2htn_oAefH2QAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
expandmade.com
2026-11-05 17:02:08
UTC ·
(5 days ago)
trolling for wp-login [05/Nov/2026:17:02:08 "GET /wp-login.php"]
Web App Attack
🇨🇭
dalslab ltd
2026-11-05 10:54:53
UTC ·
(5 days ago)
[05/Nov/2026:11:54:32 +0100] - 404 404 - GET https vault.dalslab.com "/license.txt" [Client 201.79.97.215] [Length 844] [Gzip 2.20] [Sent-to 10.1.1.248] "python-requests/2.27.1" "-"
[05/Nov/2026:11:54:35 +0100] - 404 404 - GET https search.dalslab.co ...
show more
[05/Nov/2026:11:54:32 +0100] - 404 404 - GET https vault.dalslab.com "/license.txt" [Client 201.79.97.215] [Length 844] [Gzip 2.20] [Sent-to 10.1.1.248] "python-requests/2.27.1" "-"
[05/Nov/2026:11:54:35 +0100] - 404 404 - GET https search.dalslab.com "/license.txt" [Client 201.79.97.215] [Length 2874] [Gzip 2.24] [Sent-to 10.1.1.41] "python-requests/2.27.1" "-"
[05/Nov/2026:11:54:43 +0100] - 404 404 - GET https pdf.dalslab.com "/license.txt" [Client 201.79.97.215] [Length 2688] [Gzip -] [Sent-to 10.1.1.231] "python-requests/2.27.1" "-"
[05/Nov/2026:11:54:46 +0100] - 404 404 - GET https nc.dalslab.com "/license.txt" [Client 201.79.97.215] [Length 1844] [Gzip -] [Sent-to 10.1.1.253] "python-requests/2.27.1" "-"
[05/Nov/2026:11:54:53 +0100] - 404 404 - GET https git.dalslab.com "/license.txt" [Client 201.79.97.215] [Length 11] [Gzip -] [Sent-to 10.1.1.40] "python-requests/2.27.1" "-"
...
show less
Web Spam
Brute-Force
Bad Web Bot
Web App Attack
2026-11-05 05:24:03
UTC ·
(5 days ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇩🇪
wpadm4
2026-11-05 01:01:21
UTC ·
(6 days ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 00:00:28
UTC ·
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 2002:c94f:61d7::c94f:61d7 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 19:00:19.297756 2026] [security2:error] [pid 7600:tid 7600] [client 2002:c ...
show more
(mod_security) mod_security (id:225170) triggered by 2002:c94f:61d7::c94f:61d7 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 19:00:19.297756 2026] [security2:error] [pid 7600:tid 7600] [client 2002:c94f:61d7::c94f:61d7:54322] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thinkingepic.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thinkingepic.com"] [uri "/wp-json/wp/v2/users"] [unique_id "auvHExcWT83Q2AexV_hRnQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇹
Malta
2026-11-04 23:52:03
UTC ·
(6 days ago)
201.79.97.215 - - [05/Nov/2026:00:52:03 +0100] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.130 Safari/537.36"
Hacking
Web App Attack
🇩🇪
Séfora Srl
2026-11-04 23:03:02
UTC ·
(6 days ago)
crowdsecurity/http-wordpress_user-enum detected by CrowdSec
Web App Attack
🇨🇭
4server
2026-11-04 21:11:49
UTC ·
(6 days ago)
[WedNov0422:11:46.1048422026][security2:error][pid3904506:tid3904660][client2002:c94f:61d7::c94f:61d7:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"xmlrpc\\\\\\\\.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_rules/03_asl_dos.c ...
show more
[WedNov0422:11:46.1048422026][security2:error][pid3904506:tid3904660][client2002:c94f:61d7::c94f:61d7:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"xmlrpc\\\\\\\\.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_rules/03_asl_dos.conf\"][line\"65\"][id\"392331\"][rev\"3\"][msg\"Atomicorp.comWAFRules:xmlrpcDOSattack\"][severity\"CRITICAL\"][hostname\"avvnicolaurbani.ch\"][uri\"/xmlrpc.php\"][unique_id\"auufkoRi9du48mqp8nbb4QAAARY\"]
show less
Hacking
Web App Attack
