🇲🇽
octageeks.com
2026-06-24 04:06:06
(12 hours ago)
Wordpress malicious attack:[octablocked]
Web App Attack
2026-06-23 15:05:06
(1 day ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-23 14:10:03
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 10:09:55.846503 2026] [security2:error] [pid 10794:tid 10794] [client 217.154.106.221:34758] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||targetbinario.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "targetbinario.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajqTs_yKLYvkvqHDzcj2IQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 13:54:32
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 09:54:25.966301 2026] [security2:error] [pid 24953:tid 24953] [client 217.154.106.221:60250] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||losbarbarosdelnorte.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "losbarbarosdelnorte.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajqQETZYkxi_VQEiv620PAAAAEc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 13:15:19
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 09:15:14.095985 2026] [security2:error] [pid 721:tid 721] [client 217.154.106.221:59118] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mirai-labo.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mirai-labo.com"] [uri "/wp-json/wp/v2/users/6"] [unique_id "ajqG4m4czjI_wADCX5MwCAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-23 12:59:53
(1 day ago)
ccideas.com.au:443 217.154.106.221 - - [23/Jun/2026:22:59:50 +1000] "GET /wordpress/xmlrpc.php HTTP/ ...
show more
ccideas.com.au:443 217.154.106.221 - - [23/Jun/2026:22:59:50 +1000] "GET /wordpress/xmlrpc.php HTTP/1.1" 404 94137 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36, Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 11:46:35
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 07:46:32.136351 2026] [security2:error] [pid 21837:tid 21837] [client 217.154.106.221:50606] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lambert-heating-and-air.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lambert-heating-and-air.com"] [uri "/wp-json/wp/v2/users/3"] [unique_id "ajpyGNmXRYOHYXCs9TbtwAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob.fr
2026-06-23 11:15:08
(1 day ago)
Repeated 403 errors, blocked by Fail2ban in custom-403 jail
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-23 10:56:26
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 06:56:21.666966 2026] [security2:error] [pid 11868:tid 11868] [client 217.154.106.221:46386] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.riedmannfamily.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.riedmannfamily.com"] [uri "/wp-json/wp/v2/users/9"] [unique_id "ajpmVbxwUdoCN85nTkivSAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
polycoda
2026-06-23 10:44:13
(1 day ago)
🔑 Probes for xmlrpc.php everywhere
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 08:44:16
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 04:44:11.026324 2026] [security2:error] [pid 13457:tid 13457] [client 217.154.106.221:47034] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hopeforthefuture.africa.greenlight.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hopeforthefuture.africa.greenlight.us"] [uri "/wp-json/wp/v2/users/1"] [unique_id "ajpHWwiBLNsmJaXLo_-tZAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 08:23:26
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 04:23:19.873316 2026] [security2:error] [pid 28297:tid 28297] [client 217.154.106.221:38100] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||joebankx.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "joebankx.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "ajpCd0TF-SZGw1iPqRza5wAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 07:23:32
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 217.154.106.221 (ip217.154.106-221.pbiaas.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 03:23:27.400252 2026] [security2:error] [pid 17846:tid 17846] [client 217.154.106.221:53302] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||4115thewestford.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "4115thewestford.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajo0bzFveHU3VYHON4X5HwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇷
setupgr
2026-06-23 07:05:29
(1 day ago)
(mod_security) mod_security (id:11000011) triggered by 217.154.106.221 (ES/Spain/Madrid/Madrid/-/[AS ...
show more
(mod_security) mod_security (id:11000011) triggered by 217.154.106.221 (ES/Spain/Madrid/Madrid/-/[AS8560 IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE.]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jun 23 10:05:25.476038 2026] [security2:error] [pid 1934813:tid 1934883] [remote 217.154.106.221:39788] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "pbiaas.com" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "131"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: ip217.154.106-221.pbiaas.com"] [severity "CRITICAL"] [hostname "gyrosplace.gr"] [uri "/wp-sitemap-users-1.xml"] [unique_id "ajowNfVHAYoCTqtXWiXwmAAAjQ0"]
show less
Port Scan
🇺🇸
mnsf
2026-06-23 07:05:22
(1 day ago)
Abuse Detected (1)
Brute-Force
Web App Attack