🇺🇸
TPI-Abuse
2026-06-13 02:25:26
(19 minutes ago)
(mod_security) mod_security (id:225170) triggered by 212.77.241.90 (vm1.ivd.omc.net): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 212.77.241.90 (vm1.ivd.omc.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 22:25:19.163748 2026] [security2:error] [pid 3768:tid 3768] [client 212.77.241.90:54596] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fatbastardcompetition.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fatbastardcompetition.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiy_j1asqjuz7t8dJPe5UAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Lino Project
2026-06-13 02:04:57
(39 minutes ago)
212.77.241.90 - - [13/Jun/2026:04:04:53 +0200] "POST /xmlrpc.php HTTP/2.0" 403 455 "-" "Mozilla/5.0 ...
show more
212.77.241.90 - - [13/Jun/2026:04:04:53 +0200] "POST /xmlrpc.php HTTP/2.0" 403 455 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob.fr
2026-06-13 00:30:07
(2 hours ago)
Repeated 404 errors, blocked by Fail2ban in custom-404 jail
Bad Web Bot
2026-06-12 23:32:23
(3 hours ago)
Portscan: TCP/443 (4x), TCP/25, TCP/2525
Port Scan
🇩🇪
sverson
2026-06-12 23:00:51
(3 hours ago)
Trolling for resource vulnerabilities
Hacking
🇺🇸
TPI-Abuse
2026-06-12 22:45:10
(3 hours ago)
(mod_security) mod_security (id:225170) triggered by 212.77.241.90 (vm1.ivd.omc.net): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 212.77.241.90 (vm1.ivd.omc.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 18:45:02.714667 2026] [security2:error] [pid 19701:tid 19701] [client 212.77.241.90:39354] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||stoughtonpipeandwelding.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "stoughtonpipeandwelding.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aiyL7mmv_VYPntN_O4RoPAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 20:36:07
(6 hours ago)
(mod_security) mod_security (id:225170) triggered by 212.77.241.90 (vm1.ivd.omc.net): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 212.77.241.90 (vm1.ivd.omc.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 16:36:02.331589 2026] [security2:error] [pid 9094:tid 9094] [client 212.77.241.90:41460] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cathybermanmft.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cathybermanmft.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aixtsnin0t20rwG1MVgXkgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
ELYAZ
2026-06-12 20:05:30
(6 hours ago)
(wordpress) Failed wordpress login from 212.77.241.90 (DE/Germany/-): (CF_ENABLE)
Brute-Force
🇺🇸
TPI-Abuse
2026-06-12 19:28:21
(7 hours ago)
(mod_security) mod_security (id:225170) triggered by 212.77.241.90 (vm1.ivd.omc.net): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 212.77.241.90 (vm1.ivd.omc.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 15:28:16.835409 2026] [security2:error] [pid 24929:tid 24929] [client 212.77.241.90:60334] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mainefirst.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mainefirst.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aixd0NK-ecjqhBwMDdhjTAAAACA"], referer: https://mainefirst.org/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇷
setupgr
2026-06-12 19:23:43
(7 hours ago)
(XMLRPC) WP XMLPRC Attack 212.77.241.90: 1 in the last 86400 secs; Ports: *; Direction: inout; Trigg ...
show more
(XMLRPC) WP XMLPRC Attack 212.77.241.90: 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 212.77.241.90 - - [12/Jun/2026:22:20:52 +0300] "POST /xmlrpc.php HTTP/2.0" 404 33432 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
show less
Port Scan
2026-06-12 19:00:04
(7 hours ago)
Bot / scanning and/or hacking attempts: [1/1] done, POST /xmlrpc.php HTTP/2.0, GET /wp-json/ultimate ...
show more
Bot / scanning and/or hacking attempts: [1/1] done, POST /xmlrpc.php HTTP/2.0, GET /wp-json/ultimate-member/v1/users HTTP/2.0
show less
Hacking
Web App Attack
🇫🇷
LRob.fr
2026-06-12 19:00:04
(7 hours ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 18:58:20
(7 hours ago)
(mod_security) mod_security (id:225170) triggered by 212.77.241.90 (vm1.ivd.omc.net): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 212.77.241.90 (vm1.ivd.omc.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 14:58:16.095236 2026] [security2:error] [pid 28390:tid 28390] [client 212.77.241.90:33792] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||robotsinme.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "robotsinme.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aixWyDVF_nQOUOOEz9nWMQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-06-12 18:53:11
(7 hours ago)
[FriJun1220:53:09.3438922026][security2:error][pid4117285:tid4117403][client212.77.241.90:0]ModSecur ...
show more
[FriJun1220:53:09.3438922026][security2:error][pid4117285:tid4117403][client212.77.241.90:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"feldenkraistherapy.ch\"][uri\"/xmlrpc.php\"][unique_id\"aixVlXGMlHsQP8niYLs6egAAANI\"]
show less
Port Scan
Brute-Force
Web App Attack
🇵🇾
SecOpsSL
2026-06-12 18:45:26
(7 hours ago)
212.77.241.90 - - [12/Jun/2026:15:45:25 -0300] "POST /xmlrpc.php HTTP/1.1" 403 281 "-" "Mozilla/5.0 ...
show more
212.77.241.90 - - [12/Jun/2026:15:45:25 -0300] "POST /xmlrpc.php HTTP/1.1" 403 281 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36, Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
show less
Brute-Force
Web App Attack