🇺🇸
TPI-Abuse
2026-11-10 10:26:37
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 213.94.57.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:26:32.226675 2026] [security2:error] [pid 7199:tid 7199] [client 213.94.57.21:9009] ModSec ...
show more
(mod_security) mod_security (id:225170) triggered by 213.94.57.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:26:32.226675 2026] [security2:error] [pid 7199:tid 7199] [client 213.94.57.21:9009] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||zacharypowers.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "zacharypowers.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "avLxWDMP96b3dI7WHspfxgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-11-09 15:05:01
UTC ·
(2 days ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-login-lockdown-high.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 12:04:22
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 213.94.57.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 07:04:15.048621 2026] [security2:error] [pid 7467:tid 7467] [client 213.94.57.21:8345] ModSec ...
show more
(mod_security) mod_security (id:225170) triggered by 213.94.57.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 07:04:15.048621 2026] [security2:error] [pid 7467:tid 7467] [client 213.94.57.21:8345] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||stoughtonpipeandwelding.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "stoughtonpipeandwelding.net"] [uri "/wp-json/wp/v2/users"] [unique_id "au8Tv6C3M3sdJliKZzjB-gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
tvipper.com
2026-11-06 11:35:14
UTC ·
(5 days ago)
probing for exposed files and admin pages: 2 attempts within 10 minutes, seen by Cloudflare WAF (reported by RemotePower)
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 06:39:24
UTC ·
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 213.94.57.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 01:39:16.382987 2026] [security2:error] [pid 20304:tid 20304] [client 213.94.57.21:8844] ModS ...
show more
(mod_security) mod_security (id:225170) triggered by 213.94.57.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 01:39:16.382987 2026] [security2:error] [pid 20304:tid 20304] [client 213.94.57.21:8844] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||sharonmauldin.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sharonmauldin.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au12FM-n0aY1YNOiNUhkhwAAAAU"], referer: https://sharonmauldin.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-11-06 01:10:01
UTC ·
(6 days ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
lostswordfish.com
2026-11-05 21:10:07
UTC ·
(6 days ago)
Wordfence waf block on registrymatters
Web App Attack
🇨🇿
lp
2026-11-05 00:05:20
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 213.94.57.21
2026-11-05T00:50:51+0100 vpn Access-Reject station: 213.94.57.21
Brute-Force
Web App Attack
🇨🇭
4server
2026-10-28 10:33:13
UTC ·
(2 weeks ago)
[WedOct2811:33:09.0544982026][security2:error][pid769686:tid769890][client213.94.57.21:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"960 ...
show more
[WedOct2811:33:09.0544982026][security2:error][pid769686:tid769890][client213.94.57.21:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"www.swisservers.com\"][uri\"/xmlrpc.php\"][unique_id\"auHPZcQTJUS7Lz4j_QAzkgAAAQo\"]
show less
Hacking
Web App Attack
🇩🇪
LRob
2026-10-27 18:22:40
UTC ·
(2 weeks ago)
Web exploit attempt | method: POST, GET | path: /wp-login.php | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Hacking
Web App Attack
2024-10-06 08:10:29
UTC ·
(2 years ago)
Ports: 25,110,143,993,995; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
