๐บ๐ธ
TPI-Abuse
2023-12-17 17:07:23
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown) ...
show more
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 17 12:07:16.988859 2023] [security2:error] [pid 5135] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0:60708] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ceereel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ceereel.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZX8qxNonG8LsOD9wR6k9rQAAAAo"], referer: http://reelvalle.com///wp-json/wp/v2/users/
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2023-12-17 16:41:26
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown) ...
show more
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 17 11:41:23.062199 2023] [security2:error] [pid 29447] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0:49580] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||kildarafarms.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "kildarafarms.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZX8ks0XGCTOq7zx5vMl1BAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2023-12-17 12:35:10
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown) ...
show more
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 17 07:35:03.335699 2023] [security2:error] [pid 25391] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0:47078] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.josephshv.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.josephshv.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZX7q9waR38krhZBL7CeOQgAAAAc"], referer: http://josephsherbsandvitamins.com///wp-json/wp/v2/users/
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2023-12-17 11:46:12
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown) ...
show more
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 17 06:46:05.673583 2023] [security2:error] [pid 13022] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0:50746] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||telecompros.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "telecompros.net"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZX7ffcvRhKm0Xv143A25NAAAAAg"], referer: http://telecompros.net///wp-json/wp/v2/users/
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2023-12-17 10:32:53
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown) ...
show more
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 17 05:32:48.492152 2023] [security2:error] [pid 24707] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0:41908] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||dynamic-therapy-mn.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dynamic-therapy-mn.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZX7OUAeyx-_is-CE8C58nAAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2023-12-17 07:23:27
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown) ...
show more
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 17 02:23:19.610363 2023] [security2:error] [pid 2443] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0:43678] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||engine-watch.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "engine-watch.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZX6h5zHJjswaKjfzbPVTcgAAABM"], referer: http://engine-watch.net///wp-json/wp/v2/users/
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ณ๐ฟ
Tripwire
2023-12-16 17:13:03
(2 years ago)
Wordpress login scanning
Brute-Force
Web App Attack
๐บ๐ธ
TPI-Abuse
2023-12-16 15:09:23
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown) ...
show more
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 16 10:09:18.331247 2023] [security2:error] [pid 28670] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0:52126] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mail.method1.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mail.method1.net"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZX29nuLFsAMy9yOOewzFiQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2023-12-16 14:43:03
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown) ...
show more
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 16 09:42:57.664685 2023] [security2:error] [pid 15448] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0:47698] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||sparler.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sparler.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZX23cWaucUUCw-HdmUkwzgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2023-12-16 14:27:46
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown) ...
show more
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 16 09:27:40.564408 2023] [security2:error] [pid 26978] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0:38540] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||apeironsoft.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "apeironsoft.net"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZX2z3Lc9nm5ugIiJQAwrGAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2023-12-16 13:55:09
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown) ...
show more
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 16 08:55:01.920142 2023] [security2:error] [pid 9541] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0:58264] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||datebynumber.smogsandiego.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "datebynumber.smogsandiego.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZX2sNXJ6hNuZxIqAFdld4AAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2023-12-16 13:13:20
(2 years ago)
2401:c080:1400:7a78:5400:4ff:fe8c:ea0 - - [16/Dec/2023:13:13:20 +0000] "GET /wp-login.php HTTP/1.1" ...
show more
2401:c080:1400:7a78:5400:4ff:fe8c:ea0 - - [16/Dec/2023:13:13:20 +0000] "GET /wp-login.php HTTP/1.1" 404 134 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...
show less
Hacking
Web App Attack
๐บ๐ธ
TPI-Abuse
2023-12-16 12:32:50
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown) ...
show more
(mod_security) mod_security (id:225170) triggered by 2401:c080:1400:7a78:5400:4ff:fe8c:ea0 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 16 07:32:46.118599 2023] [security2:error] [pid 6783] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0:34142] [client 2401:c080:1400:7a78:5400:4ff:fe8c:ea0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mail.reasonable-lawn-care.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mail.reasonable-lawn-care.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZX2Y7iRyc83KJv2CR8MykgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
mawan
2023-12-14 02:19:47
(2 years ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
๐บ๐ธ
mawan
2023-12-13 00:18:19
(2 years ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack