🇩🇪
FeG Deutschland
2026-11-09 03:15:30
UTC ·
(3 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 05:40:24
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 210.79.171.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 00:40:17.366468 2026] [security2:error] [pid 17141:tid 17180] [client 210.79.171.254:41596] ...
show more
(mod_security) mod_security (id:225170) triggered by 210.79.171.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 00:40:17.366468 2026] [security2:error] [pid 17141:tid 17180] [client 210.79.171.254:41596] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ward-bergerhouse.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ward-bergerhouse.org"] [uri "/wp-json/wp/v2/users"] [unique_id "au65weV_mlgNh5U4-UYLPwAAANg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-07 01:15:03
UTC ·
(2 days ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Blocked by User-Agent Filter (Bad Bot Pattern: MSIE 6.): Mozilla/5.0 (compatible; MSIE 6.0; Windows CE; Trident/4.0) | UA: Mozilla/5.0 (compatible; MSIE 6.0; Windows CE; Trident/4.0) | (Magento Site)
show less
Hacking
Bad Web Bot
🇨🇿
Countryman
2026-11-06 01:10:01
UTC ·
(3 days ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇩🇪
nyuuzyou
2026-11-01 20:05:29
UTC ·
(1 week ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-11-01T20:05:29Z.
Bad Web Bot
🇨🇿
lp
2026-11-01 13:17:39
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 210.79.171.254
2026-11-01T14:10:01+0100 vpn Access-Reject station: 210.79.171.254
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 03:32:31
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 210.79.171.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 23:32:24.741384 2026] [security2:error] [pid 20034:tid 20034] [client 210.79.171.254:48136] ...
show more
(mod_security) mod_security (id:225170) triggered by 210.79.171.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 23:32:24.741384 2026] [security2:error] [pid 20034:tid 20034] [client 210.79.171.254:48136] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||decisiontrace.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "decisiontrace.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "auayyIS8P_vtYCAa3ePHrQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-29 05:14:12
UTC ·
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: radius.teddypot.online | URI: /xmlrpc.php | UA: Mozilla/5.0 ( ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: radius.teddypot.online | URI: /xmlrpc.php | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"PH","Cf-Connecting-Ip":"210.79.171.254","Cdn-Loop":"cloudflare; loops=1","Sec-Fetch-Site":"none","Sec-Fetch-Mode":"navigate","Accept-Encoding":"gzip, br","Cache-Control":"max-age=0","A
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 13:49:34
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 210.79.171.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 09:49:27.044597 2026] [security2:error] [pid 32495:tid 32549] [client 210.79.171.254:58618] ...
show more
(mod_security) mod_security (id:225170) triggered by 210.79.171.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 09:49:27.044597 2026] [security2:error] [pid 32495:tid 32549] [client 210.79.171.254:58618] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||leadingedgesupply.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "leadingedgesupply.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "at9aZ3CJAQCCQPLfzQ3BLwAAARc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mawan
2026-10-25 01:40:04
UTC ·
(2 weeks ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 13:08:34
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 210.79.171.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 09:08:27.661460 2026] [security2:error] [pid 6808:tid 6808] [client 210.79.171.254:58302] M ...
show more
(mod_security) mod_security (id:225170) triggered by 210.79.171.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 09:08:27.661460 2026] [security2:error] [pid 6808:tid 6808] [client 210.79.171.254:58302] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ggaccounting.services|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ggaccounting.services"] [uri "/wp-json/wp/v2/users"] [unique_id "atyty1Rl1RSKVhNHTPjzawAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
LRob
2026-10-19 04:41:22
UTC ·
(3 weeks ago)
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Bad Web Bot
🇲🇹
Malta
2026-10-17 00:47:22
UTC ·
(3 weeks ago)
210.79.171.254 - - [17/Oct/2026:02:47:22 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
Brute-force password attempt
Hacking
Web App Attack
Brute-Force
🇪🇸
Mugen
2026-10-16 03:35:30
UTC ·
(3 weeks ago)
Unauthorized VPN login attempts
Brute-Force
🇺🇸
鬼影233
2026-09-30 13:10:02
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
