🇩🇪
ITcloud
2026-10-18 18:43:42
UTC ·
(3 weeks ago)
Automated credential attack against a legacy web authentication flow: 159 matching requests observed between 2026-10-17T22:59:41+00:00 and 2026-10-18T18:43:42+00:00 UTC.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 00:36:13
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 23.226.68.154 (we.love.servers.at.ioflood.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 20:36:06.716822 2026] [security2:error] [pid 27968:tid 27968] [ ...
show more
(mod_security) mod_security (id:225170) triggered by 23.226.68.154 (we.love.servers.at.ioflood.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 20:36:06.716822 2026] [security2:error] [pid 27968:tid 27968] [client 23.226.68.154:37582] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||prcomputersolutions.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "prcomputersolutions.com"] [uri "/wp-json/wp/v2/users"] [unique_id "asbldvM0TZthngMZOK9mVAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-07 21:28:50
UTC ·
(1 month ago)
[08/Oct/2026:00:28:50 +0300] -- 23.226.68.154 Ban reason: Scanner [CMS_GENERIC] | Request: GET /wp-json/wp/v2/users?_fields=slug&per_page=100&page=1 HTTP/1.1
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-07 18:30:23
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 23.226.68.154 (we.love.servers.at.ioflood.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 14:30:19.088869 2026] [security2:error] [pid 6714:tid 6714] [cl ...
show more
(mod_security) mod_security (id:225170) triggered by 23.226.68.154 (we.love.servers.at.ioflood.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 14:30:19.088869 2026] [security2:error] [pid 6714:tid 6714] [client 23.226.68.154:43572] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||joevallone.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "joevallone.com"] [uri "/wp-json/wp/v2/users"] [unique_id "asaPu6l3sBVPy9P1TLFSjgAAAFQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-07 06:25:07
UTC ·
(1 month ago)
Web exploit attempt | method: GET | path: /wp-json/wp/v2/users | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 20:47:28
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 23.226.68.154 (we.love.servers.at.ioflood.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 16:47:22.780127 2026] [security2:error] [pid 7662:tid 7662] [cl ...
show more
(mod_security) mod_security (id:225170) triggered by 23.226.68.154 (we.love.servers.at.ioflood.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 16:47:22.780127 2026] [security2:error] [pid 7662:tid 7662] [client 23.226.68.154:34068] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||innolympics.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "innolympics.com"] [uri "/wp-json/wp/v2/users"] [unique_id "asVeWrDxxxwHyNZWh2cRfAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-10-06 15:38:18
UTC ·
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇮🇹
VHosting
2026-10-02 22:55:04
UTC ·
(1 month ago)
Detected mail brute force attack from different servers
Brute-Force
🇺🇸
TPI-Abuse
2026-10-02 19:20:50
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 23.226.68.154 (we.love.servers.at.ioflood.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 15:20:44.046307 2026] [security2:error] [pid 1365:tid 1365] [cl ...
show more
(mod_security) mod_security (id:225170) triggered by 23.226.68.154 (we.love.servers.at.ioflood.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 15:20:44.046307 2026] [security2:error] [pid 1365:tid 1365] [client 23.226.68.154:60286] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jobs.evolute.io|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jobs.evolute.io"] [uri "/wp-json/wp/v2/users"] [unique_id "asAEDFv7wBELOP1dabN9zAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 07:46:24
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 23.226.68.154 (we.love.servers.at.ioflood.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 03:46:17.251201 2026] [security2:error] [pid 1332:tid 1364] [cl ...
show more
(mod_security) mod_security (id:225170) triggered by 23.226.68.154 (we.love.servers.at.ioflood.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 03:46:17.251201 2026] [security2:error] [pid 1332:tid 1364] [client 23.226.68.154:59300] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||kemalinal.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "kemalinal.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ar9hSRMoL313enhXYMUuDgAAARc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Martin Lundstrom
2026-06-03 09:23:58
UTC ·
(5 months ago)
https://www.eagleeye-intelligence.com — WordPress attack. Automatically detected and blocked.
Web App Attack
🇺🇸
lostswordfish.com
2026-06-01 21:04:04
UTC ·
(5 months ago)
Wordfence waf block on fairregistry
Web App Attack
🇨🇦
polycoda
2026-05-31 11:10:07
UTC ·
(5 months ago)
📄 Probes for wp-login.php and other inexistent URLs
Hacking
Web App Attack
