🇺🇸
TPI-Abuse
2026-08-26 10:00:42
(24 minutes ago)
(mod_security) mod_security (id:225170) triggered by 202.92.5.25 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 202.92.5.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 06:00:37.410786 2026] [security2:error] [pid 25798:tid 25798] [client 202.92.5.25:57186] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jimrichardart.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jimrichardart.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ao65RQCTczqJ57rop6wZhwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-26 09:34:19
(51 minutes ago)
(mod_security) mod_security (id:225170) triggered by 202.92.5.25 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 202.92.5.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 05:34:14.593994 2026] [security2:error] [pid 16019:tid 16019] [client 202.92.5.25:38458] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||peterndudar.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "peterndudar.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ao6zFkOyF4f3y-HFgBtnNgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xxkodedxx
2026-08-26 05:56:16
(4 hours ago)
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get in 10m window.
...
show more
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get in 10m window.
Active: 05:55:17 UTC
Volume: 1 honeypot probe(s)
Bait taken: /wp-json/rankmath/v1/getHead?url=https://cards.zvxlabs.com
Vhost fishing: cards.zvxlabs.com
UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
🇩🇪
Marc
2026-08-26 04:46:18
(5 hours ago)
202.92.5.25 - - [26/Aug/2026:02:31:06 +0200] "POST /wp-login.php HTTP/2.0" 403 11965 "-" "Mozilla/5. ...
show more
202.92.5.25 - - [26/Aug/2026:02:31:06 +0200] "POST /wp-login.php HTTP/2.0" 403 11965 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 202.92.5.25 - - [26/Aug/2026:04:16:39 +0200] "GET /wp-login.php HTTP/2.0" 200 3453 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 202.92.5.25 - - [26/Aug/2026:06:30:34 +0200] "GET /wp-login.php HTTP/2.0" 200 3453 "https://als-arnsberg.de/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 202.92.5.25 - - [26/Aug/2026:06:30:34 +0200] "POST /wp-login.php HTTP/2.0" 200 3266 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 202.92.5.25 - - [26/Aug/2026:06:46:17 +0200] "GET /wp-login.php HTTP/2.0" 200 4255 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/5
show less
Brute-Force
Web App Attack
🇲🇽
octageeks.com
2026-08-26 04:12:11
(6 hours ago)
Wordpress malicious attack:[octaflood]
Web App Attack
🇫🇷
masterguru
2026-08-26 04:07:26
(6 hours ago)
wp-login request blocked, no referer. Pattern match "wp-login.php" at REQUEST_URI. (88020-195)
Hacking
🇩🇪
london2038.com
2026-08-26 03:23:08
(7 hours ago)
Attacking WordPress
202.92.5.25 - - [26/Aug/2026:05:23:01 +0200] "POST /wp-login.php HTTP/2.0" 503 1 ...
show more
Attacking WordPress
202.92.5.25 - - [26/Aug/2026:05:23:01 +0200] "POST /wp-login.php HTTP/2.0" 503 19289 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
show less
Brute-Force
Web App Attack
🇹🇷
oalver
2026-08-26 03:09:55
(7 hours ago)
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_path_signa ...
show more
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_path_signature. Sources: nginx. Details: path_signature: request to /wp-login.php (HTTP 200). First seen: 2026-08-09. Risk score: 100/100.
show less
Web App Attack
🇬🇧
BRHosting
2026-08-26 00:30:03
(9 hours ago)
Wordpress brute force attack for login credentials (eg xmlrc.php or wp-login.php)
Brute-Force
Web App Attack
🇩🇪
Viveronese
2026-08-26 00:29:18
(9 hours ago)
Wordpress vulnerability scanning
Web App Attack
🇩🇪
AlexEventfahrtenIPDB
2026-08-25 23:59:57
(10 hours ago)
[Wed Aug 26 01:59:52.914724 2026] [authz_core:error] [pid 889640:tid 889656] [remote 202.92.5.25:483 ...
show more
[Wed Aug 26 01:59:52.914724 2026] [authz_core:error] [pid 889640:tid 889656] [remote 202.92.5.25:48366] AH01630: client denied by server configuration: /var/www/std-sites/cadillac/wp-login.php
[Wed Aug 26 01:59:56.169562 2026] [authz_core:error] [pid 889639:tid 889690] [remote 202.92.5.25:48368] AH01630: client denied by server configuration: /var/www/std-sites/cadillac/wp-login.php, referer: https://powerstar.spdns.de/
...
show less
Brute-Force
Web App Attack
🇨🇦
KIsmay
2026-08-25 23:53:42
(10 hours ago)
Aug 25 16:39:32 www4 WPAudit[1480029]: 202.92.5.25 katharinedickerson.com "Mozilla/5.0 (Windows NT 1 ...
show more
Aug 25 16:39:32 www4 WPAudit[1480029]: 202.92.5.25 katharinedickerson.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" katharinedickerson:Katharinedickerson88 FAIL
Aug 25 19:07:17 www4 WPAudit[1494163]: 202.92.5.25 katharinedickerson.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" katharinedickerson:Katharinedickerson@123123 FAIL
Aug 25 19:24:56 www4 WPAudit[1496015]: 202.92.5.25 www.nelsonbcwelding.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" sbd-admin:sbd-admin91 FAIL
Aug 25 19:46:49 www4 WPAudit[1497770]: 202.92.5.25 www.vhsport.ca "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" vhsport:Vhsport234 FAIL
Aug 25 19:53:41 www4 WPAudit[1498343]: 202.92.5.25 imaginesalmon.com "Mozilla/5.0 (Windows NT 10.0; Win64; x6
...
show less
Brute-Force
Web App Attack
🇵🇱
bmino.pl
2026-08-25 23:00:42
(11 hours ago)
Autoban IP(2): 202.92.5.25 - Hostname: INET - City: Dich Vong - Region: Hanoi - Country: Vietnam - L ...
show more
Autoban IP(2): 202.92.5.25 - Hostname: INET - City: Dich Vong - Region: Hanoi - Country: Vietnam - Location: 21.0341,105.796 - Organization: iNET Media Company Limited - failed attempts.
show less
Web App Attack
🇫🇷
tecnicorioja
2026-08-25 22:01:30
(12 hours ago)
wp-login attack [25/Aug/2026:21:41:31
Brute-Force
Web App Attack
🇹🇷
oalver
2026-08-25 21:11:56
(13 hours ago)
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_path_signa ...
show more
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_path_signature. Sources: nginx. Details: path_signature: request to /wp-login.php (HTTP 200). First seen: 2026-08-09. Risk score: 90/100.
show less
Web App Attack