🇩🇪
LRob
2026-08-28 18:30:56
(4 hours ago)
Malicious web request: probing for secrets, traversal or a known exploit path | method: GET | path: ...
show more
Malicious web request: probing for secrets, traversal or a known exploit path | method: GET | path: /xmlrpc.php | 2026-08-28 18:30 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 17:36:47
(5 hours ago)
(mod_security) mod_security (id:225170) triggered by 202.73.26.211 (id1.serverismaya.com): 1 in the ...
show more
(mod_security) mod_security (id:225170) triggered by 202.73.26.211 (id1.serverismaya.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 13:36:43.931395 2026] [security2:error] [pid 3356584:tid 3356761] [client 202.73.26.211:49986] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||neotienda.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "neotienda.com"] [uri "/wp-json/wp/v2/users"] [unique_id "apHHK1aK7I3gFT1ABKQ2PgAAAQo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 00:54:41
(21 hours ago)
(mod_security) mod_security (id:225170) triggered by 202.73.26.211 (id1.serverismaya.com): 1 in the ...
show more
(mod_security) mod_security (id:225170) triggered by 202.73.26.211 (id1.serverismaya.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 20:54:35.429519 2026] [security2:error] [pid 5987:tid 5987] [client 202.73.26.211:60004] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.dandksupply.ewingmissouri.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.dandksupply.ewingmissouri.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "apDcS-QtSMgizpKXGjhYGQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-28 00:09:04
(22 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 23:49:26
(23 hours ago)
(mod_security) mod_security (id:225170) triggered by 202.73.26.211 (id1.serverismaya.com): 1 in the ...
show more
(mod_security) mod_security (id:225170) triggered by 202.73.26.211 (id1.serverismaya.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 19:49:18.294928 2026] [security2:error] [pid 18644:tid 18676] [client 202.73.26.211:51112] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||guitarprimer.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "guitarprimer.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "apDM_jwuExCZoU9A5GwD-gAAAZM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
www.winos.me
2026-08-27 23:16:40
(23 hours ago)
Scanning for sensitive files/paths: /wp-login.php
Hacking
Web App Attack
🇩🇪
ger-stg-sifi1
2026-08-27 23:15:54
(23 hours ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇫🇮
JRID
2026-08-27 13:00:56
(1 day ago)
Detected by CrowdSec + Suricata IDS: automated attack/scan against web servers.
Brute-Force
Web App Attack
🇲🇹
Malta
2026-08-27 09:27:07
(1 day ago)
202.73.26.211 - - [27/Aug/2026:11:27:07 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows N ...
show more
202.73.26.211 - - [27/Aug/2026:11:27:07 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
Brute-force password attempt
show less
Hacking
Web App Attack
Brute-Force
🇺🇸
lostswordfish.com
2026-08-27 09:22:04
(1 day ago)
Wordfence waf block on ncrsol
Web App Attack
🇷🇴
SpamStopper
2026-08-27 07:49:29
(1 day ago)
Fail2Ban - WP Spoofing
Port Scan
Brute-Force
Web App Attack
🇩🇪
ger-stg-sifi1
2026-08-26 20:26:01
(2 days ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
FeG Deutschland
2026-08-26 17:53:12
(2 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-08-26 15:10:48
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 202.73.26.211 (id1.serverismaya.com): 1 in the ...
show more
(mod_security) mod_security (id:225170) triggered by 202.73.26.211 (id1.serverismaya.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 11:10:42.206653 2026] [security2:error] [pid 7250:tid 7250] [client 202.73.26.211:44562] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||robotsinme.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "robotsinme.org"] [uri "/wp-json/wp/v2/users"] [unique_id "ao8B8hYOFj9HhbK9SfiG9wAAABw"], referer: https://robotsinme.org/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-26 13:09:15
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 202.73.26.211 (id1.serverismaya.com): 1 in the ...
show more
(mod_security) mod_security (id:225170) triggered by 202.73.26.211 (id1.serverismaya.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 09:09:09.300233 2026] [security2:error] [pid 28911:tid 28911] [client 202.73.26.211:39536] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||annpietrangelo.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "annpietrangelo.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ao7ldcHjSVqM-tuHsl8BJgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack