🇨🇭
4server
2026-11-13 05:18:38
UTC ·
(6 hours ago)
[FriNov1306:18:32.0597102026][security2:error][pid365460:tid365524][client212.119.46.67:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:alter\|drop\)\\\\\\\\b[a-z0-9] \\\\\\\\b\(\?:column\|database\|procedure\|table\) ...
show more
[FriNov1306:18:32.0597102026][security2:error][pid365460:tid365524][client212.119.46.67:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:alter\|drop\)\\\\\\\\b[a-z0-9] \\\\\\\\b\(\?:column\|database\|procedure\|table\)\\\\\\\\b\|delete[[:space:]].{1\,100} update[a-z0-9] set.{1\,100} =\|unionallselect\|\\\\\\\\bunion\\\\\\\\b.{1\,100}\?\\\\\\\\bselect\\\\\\\\b.{0\,200}[a-z0-9] from\|select\(\?:load_file\|char\?\\\\\\\\\(\)\|\(\?:insert\|r...\"atARGS:requests[1][body][requests][1][path].[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"315\"][id\"340144\"][rev\"38\"][msg\"Atomicorp.comWAFRules:GenericSQLinjectionprotection2\"][data\"139593\"][severity\"CRITICAL\"][tag\"SQLi\"][hostname\"www.shadowdrummer.ch\"][uri\"/\"][unique_id\"avadqEHWgP_ggPrN7kMMiAAAAAU\"]
show less
Hacking
Web App Attack
2026-10-18 18:06:38
UTC ·
(3 weeks ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
2026-10-06 15:30:34
UTC ·
(1 month ago)
[Firewall Canary] Temporary ban due to firewall rule match [URI:*/xmlrpc.php]
Bad Web Bot
Web App Attack
🇫🇮
bittiguru.fi
2026-09-23 20:22:50
UTC ·
(1 month ago)
212.119.46.67 - [23/Sep/2026:23:22:11 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "4.66"
212.119.46.67 - [23/Sep/2026:23:22:50 +030 ...
show more
212.119.46.67 - [23/Sep/2026:23:22:11 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "4.66"
212.119.46.67 - [23/Sep/2026:23:22:50 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "4.66"
...
show less
Hacking
Brute-Force
Web App Attack
🇩🇪
LRob
2026-09-14 09:18:52
UTC ·
(1 month ago)
Malicious web request: probing for secrets, traversal or a known exploit path | method: POST | path: /xmlrpc.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 | 2026-09-14 09:18 ...
show more
Malicious web request: probing for secrets, traversal or a known exploit path | method: POST | path: /xmlrpc.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 | 2026-09-14 09:18 UTC
show less
Hacking
Web App Attack
🇫🇷
Yepngo
2026-07-25 23:13:27
UTC ·
(3 months ago)
212.119.46.67 - - [26/Jul/2026:01:06:49 +0200] "POST /wp-login.php HTTP/2.0" 200 11350 "https://yepngo.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
212.119.46.67 - - [26/Jul ...
show more
212.119.46.67 - - [26/Jul/2026:01:06:49 +0200] "POST /wp-login.php HTTP/2.0" 200 11350 "https://yepngo.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
212.119.46.67 - - [26/Jul/2026:01:13:26 +0200] "POST /wp-login.php HTTP/2.0" 200 11353 "https://yepngo.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-25 05:39:24
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 212.119.46.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 01:39:21.135924 2026] [security2:error] [pid 1270182:tid 1270182] [client 212.119.46.67:2114 ...
show more
(mod_security) mod_security (id:225170) triggered by 212.119.46.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 01:39:21.135924 2026] [security2:error] [pid 1270182:tid 1270182] [client 212.119.46.67:21147] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||churchtop.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "churchtop.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amRMCabV1R52KroB0kN2jgAAABk"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-24 05:31:18
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 212.119.46.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 24 01:31:13.558681 2026] [security2:error] [pid 10378:tid 10378] [client 212.119.46.67:50015] M ...
show more
(mod_security) mod_security (id:225170) triggered by 212.119.46.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 24 01:31:13.558681 2026] [security2:error] [pid 10378:tid 10378] [client 212.119.46.67:50015] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||desertdwellings.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "desertdwellings.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aesAIb4Ge-8NSKO3iaXAfgAAAAU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
ptlab
2026-04-21 02:47:20
UTC ·
(6 months ago)
Detected wp_login attack from WP-host.
Hacking
Web App Attack
🇺🇸
octageeks.com
2026-04-20 04:06:41
UTC ·
(6 months ago)
Wordpress malicious attack:[octaxmlrpc]
Web App Attack
🇺🇸
TPI-Abuse
2026-03-17 21:04:04
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 212.119.46.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 17 17:03:56.488590 2026] [security2:error] [pid 11958:tid 11958] [client 212.119.46.67:56323] M ...
show more
(mod_security) mod_security (id:225170) triggered by 212.119.46.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 17 17:03:56.488590 2026] [security2:error] [pid 11958:tid 11958] [client 212.119.46.67:56323] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||salsberggroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "salsberggroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abnBvGAyhQzc_ktxodoWYwAAAB8"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
kjaerulff
2026-03-10 10:03:12
UTC ·
(8 months ago)
Failed Wordpress login using wp-login.php
Web App Attack
🇺🇸
TPI-Abuse
2026-03-10 09:41:11
UTC ·
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 212.119.46.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 10 05:41:07.636982 2026] [security2:error] [pid 11607:tid 11607] [client 212.119.46.67:0] ModSe ...
show more
(mod_security) mod_security (id:225170) triggered by 212.119.46.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 10 05:41:07.636982 2026] [security2:error] [pid 11607:tid 11607] [client 212.119.46.67:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||southernbroadcast.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "southernbroadcast.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aa_nM8uh8xDTSks_1_qpPgAAAAE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-07 20:40:31
UTC ·
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 212.119.46.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 07 15:40:28.937050 2026] [security2:error] [pid 17522:tid 17522] [client 212.119.46.67:12579] M ...
show more
(mod_security) mod_security (id:225170) triggered by 212.119.46.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 07 15:40:28.937050 2026] [security2:error] [pid 17522:tid 17522] [client 212.119.46.67:12579] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gamedayincentives.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gamedayincentives.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aayNPAusoY918oJN5uTw7QAAAAY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-04 02:51:10
UTC ·
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 212.119.46.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 03 21:51:07.062777 2026] [security2:error] [pid 30369:tid 30369] [client 212.119.46.67:55519] M ...
show more
(mod_security) mod_security (id:225170) triggered by 212.119.46.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 03 21:51:07.062777 2026] [security2:error] [pid 30369:tid 30369] [client 212.119.46.67:55519] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nowell.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nowell.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aaeeG4AdIZelIBoybazqiwAAAAE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
