|
🇺🇸
CBJ
|
|
fail2ban: apache-filepath-recon
...
|
Web App Attack
|
|
|
🇺🇸
CBJ
|
|
fail2ban: apache-filepath-recon
...
|
Web App Attack
|
|
|
🇿🇦
Tokolosh Hunters
|
|
AutoBlockWindow-Known bad useragent query-2026-05-27 14:58:25
|
Bad Web Bot
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 209.97.168.229 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.97.168.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 02:58:27.814514 2026] [security2:error] [pid 26958:tid 26958] [client 209.97.168.229:62726] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sr.handyrehab.com"] [uri "/wp-config.php"] [unique_id "ahaWEx1KFqDexm4YD36gEAAAAAU"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇧🇪
cmbplf
|
|
17.148 requests in 1 hour (4d18h59m)
|
Brute-Force
Bad Web Bot
|
|
|
🇺🇦
URAN Publishing Service
|
|
209.97.168.229 - - [21/May/2026:22:43:02 +0300] "GET /wp-admin/about.php HTTP/1.1" 404 769 "-" "Mozl ...
show more
209.97.168.229 - - [21/May/2026:22:43:02 +0300] "GET /wp-admin/about.php HTTP/1.1" 404 769 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36Team Anon Force"
209.97.168.229 - - [21/May/2026:22:43:05 +0300] "GET /wp-content/about.php HTTP/1.1" 404 769 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36Team Anon Force"
...
show less
|
Web App Attack
|
|
|
🇺🇦
URAN Publishing Service
|
|
209.97.168.229 - - [16/May/2026:18:43:40 +0300] "GET /xmlrpc.php?rsd HTTP/1.1" 404 683 "https://mori ...
show more
209.97.168.229 - - [16/May/2026:18:43:40 +0300] "GET /xmlrpc.php?rsd HTTP/1.1" 404 683 "https://morino.be//wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36"
...
show less
|
Web App Attack
|
|
|
🇺🇦
URAN Publishing Service
|
|
209.97.168.229 - - [16/May/2026:12:31:16 +0300] "GET /xmlrpc.php?rsd HTTP/1.1" 404 683 "-" "Mozilla/ ...
show more
209.97.168.229 - - [16/May/2026:12:31:16 +0300] "GET /xmlrpc.php?rsd HTTP/1.1" 404 683 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
209.97.168.229 - - [16/May/2026:12:37:26 +0300] "GET /wp-includes/ID3/license.txt HTTP/1.1" 404 683 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
...
show less
|
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 209.97.168.229 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 209.97.168.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 05:30:50.628621 2026] [security2:error] [pid 14443:tid 14443] [client 209.97.168.229:59883] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||museum.henning.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "museum.henning.org"] [uri "/wp-json/wp/v2/users/"] [unique_id "agg5SvT4eyc62RHkUwwBmAAAAAM"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇧🇪
cmbplf
|
|
2.718 requests with url.path //xmlrpc.php
2.649 requests with url.path */xmlrpc.php
|
Brute-Force
Bad Web Bot
|
|