🇺🇸
TPI-Abuse
2026-11-12 14:42:28
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 207.178.75.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 09:42:20.127896 2026] [security2:error] [pid 9353:tid 9353] [client 207.178.75.216:53640] M ...
show more
(mod_security) mod_security (id:225170) triggered by 207.178.75.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 09:42:20.127896 2026] [security2:error] [pid 9353:tid 9353] [client 207.178.75.216:53640] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||tasteshop.l3l4.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tasteshop.l3l4.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avXQTMhXV72hDTjzxIU2EwAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇬
spydithreatintel
2026-11-12 05:48:43
UTC ·
(2 days ago)
Web honeypot: 3 HTTP request(s) incl. login-bruteforce. Example: POST /wp-login.php
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-11-11 01:34:24
UTC ·
(3 days ago)
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: telemetry.dont-eat-the-pudding.online | Path: /wp-login.php | User-Agent: Mozilla/5.0 (Windows NT 10.0; ...
show more
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: telemetry.dont-eat-the-pudding.online | Path: /wp-login.php | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 01:07:37
UTC ·
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 207.178.75.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:07:28.801264 2026] [security2:error] [pid 1283814:tid 1283845] [client 207.178.75.216:44 ...
show more
(mod_security) mod_security (id:225170) triggered by 207.178.75.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:07:28.801264 2026] [security2:error] [pid 1283814:tid 1283845] [client 207.178.75.216:44524] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||executiveaccounting.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "executiveaccounting.net"] [uri "/wp/wp-json/wp/v2/users"] [unique_id "avO_0DoCqTlTsEO_HKGNLwAAANc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-10 21:28:18
UTC ·
(3 days ago)
2026-11-10T16:28:17.359043-05:00 instance-20260804-1025 wordpress(netal.co)[273821]: Blocked user enumeration attempt from 207.178.75.216
...
Web App Attack
2026-11-10 19:21:04
UTC ·
(3 days ago)
Web App Attack, Hacking
Hacking
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-10 18:29:32
UTC ·
(3 days ago)
(wp_user_enum) srv101 WordPress user enumeration 207.178.75.216 (SA/Saudi Arabia/-): 8 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇩🇪
Marc
2026-11-10 11:22:42
UTC ·
(4 days ago)
207.178.75.216 - - [10/Nov/2026:12:22:40 +0100] "GET /wp-json/wp/v2/users/me HTTP/2.0" 404 483 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 207.178.75.216 - - [10/Nov/2026:12:22 ...
show more
207.178.75.216 - - [10/Nov/2026:12:22:40 +0100] "GET /wp-json/wp/v2/users/me HTTP/2.0" 404 483 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 207.178.75.216 - - [10/Nov/2026:12:22:40 +0100] "GET /wp-json/wp/v2/users/me HTTP/2.0" 404 269 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 207.178.75.216 - - [10/Nov/2026:12:22:41 +0100] "GET /wp-json/wp/v2/users/me HTTP/2.0" 404 292 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
show less
Brute-Force
🇩🇪
big-cloud.nl
2026-11-10 03:00:55
UTC ·
(4 days ago)
Try to access /xmlrpc.php
Web App Attack
🇫🇷
tecnicorioja
2026-11-09 23:00:56
UTC ·
(4 days ago)
wp-login attack [09/Nov/2026:04:43:25
Brute-Force
Web App Attack
🇩🇪
Vegascosmetics
2026-06-16 20:01:51
UTC ·
(4 months ago)
(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security
DDoS Attack
Hacking
Exploited Host
