🇩🇪
Gwyneth Llewelyn
2026-09-23 12:01:53
(1 week ago)
2404:f780:5:201:862b:2bff:fe58:ca18 - - [23/Sep/2026:13:01:52 +0100] "POST /wp-login.php HTTP/2.0" 4 ...
show more
2404:f780:5:201:862b:2bff:fe58:ca18 - - [23/Sep/2026:13:01:52 +0100] "POST /wp-login.php HTTP/2.0" 404 994 "https://alzulej.pt/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
show less
Bad Web Bot
🇮🇹
VHosting
2026-09-19 07:10:03
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-16 12:43:34
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 2404:f780:5:201:862b:2bff:fe58:ca18 (Unknown): ...
show more
(mod_security) mod_security (id:225170) triggered by 2404:f780:5:201:862b:2bff:fe58:ca18 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 08:43:28.595849 2026] [security2:error] [pid 28341:tid 28341] [client 2404:f780:5:201:862b:2bff:fe58:ca18:37628] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||yourbrandhere.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "yourbrandhere.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqqO8O1u_bh0OpAGLb3XTAAAABI"], referer: https://yourbrandhere.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-15 21:40:05
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 2404:f780:5:201:862b:2bff:fe58:ca18 (Unknown): ...
show more
(mod_security) mod_security (id:225170) triggered by 2404:f780:5:201:862b:2bff:fe58:ca18 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 17:39:52.230805 2026] [security2:error] [pid 27919:tid 27919] [client 2404:f780:5:201:862b:2bff:fe58:ca18:38574] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||riverflow.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "riverflow.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqm7KM1wH6oiAJEjfu6CHAAAAAM"], referer: https://riverflow.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-15 15:04:18
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 2404:f780:5:201:862b:2bff:fe58:ca18 (Unknown): ...
show more
(mod_security) mod_security (id:225170) triggered by 2404:f780:5:201:862b:2bff:fe58:ca18 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 11:04:05.480636 2026] [security2:error] [pid 7527:tid 7527] [client 2404:f780:5:201:862b:2bff:fe58:ca18:47048] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||theboss97fm.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "theboss97fm.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqleZZwA5kMKe2E7A29bWAAAAAk"], referer: https://theboss97fm.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-15 02:57:06
(2 weeks ago)
Malicious web request: probing for secrets, traversal or a known exploit path | method: POST | path: ...
show more
Malicious web request: probing for secrets, traversal or a known exploit path | method: POST | path: /wp-login.php | 2026-09-15 02:57 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 14:30:34
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 2404:f780:5:201:862b:2bff:fe58:ca18 (Unknown): ...
show more
(mod_security) mod_security (id:225170) triggered by 2404:f780:5:201:862b:2bff:fe58:ca18 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 10:30:27.346249 2026] [security2:error] [pid 22316:tid 22316] [client 2404:f780:5:201:862b:2bff:fe58:ca18:44438] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||easternimport.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "easternimport.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqgFA8oiCIe10QNX60bDBgAAABE"], referer: https://easternimport.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 01:46:15
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 2404:f780:5:201:862b:2bff:fe58:ca18 (Unknown): ...
show more
(mod_security) mod_security (id:225170) triggered by 2404:f780:5:201:862b:2bff:fe58:ca18 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 21:46:02.725266 2026] [security2:error] [pid 11018:tid 11018] [client 2404:f780:5:201:862b:2bff:fe58:ca18:48724] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||kwijlen.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "kwijlen.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqdR2ri6s7ULAKpxYpOltAAAAAE"], referer: https://kwijlen.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 12:19:25
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 2404:f780:5:201:862b:2bff:fe58:ca18 (Unknown): ...
show more
(mod_security) mod_security (id:225170) triggered by 2404:f780:5:201:862b:2bff:fe58:ca18 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 08:19:16.526011 2026] [security2:error] [pid 3282:tid 3282] [client 2404:f780:5:201:862b:2bff:fe58:ca18:37524] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||varnadorefamily.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "varnadorefamily.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqaUxIO1uLRkywTEotODoAAAAA0"], referer: https://varnadorefamily.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-13 00:34:59
(2 weeks ago)
Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ...
show more
Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for | method: POST | path: /wp-login.php | 2026-09-13 00:34 UTC
show less
Bad Web Bot
2026-09-11 16:30:56
(2 weeks ago)
Failed login attempt detected by Fail2Ban in plesk-panel jail
Brute-Force
🇩🇪
KiekerJan
2026-09-11 07:17:06
(2 weeks ago)
2404:f780:5:201:862b:2bff:fe58:ca18 - - [11/Sep/2026:09:17:05 +0200] "POST /wp-login.php HTTP/1.1" 4 ...
show more
2404:f780:5:201:862b:2bff:fe58:ca18 - - [11/Sep/2026:09:17:05 +0200] "POST /wp-login.php HTTP/1.1" 404 181 "https://noavandewijdeven.nl/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
2404:f780:5:201:862b:2bff:fe58:ca18 - - [11/Sep/2026:09:17:05 +0200] "GET /wp-admin/ HTTP/1.1" 404 181 "https://noavandewijdeven.nl/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
dtorrer
2026-04-30 00:40:57
(5 months ago)
Forged login request.
Brute-Force
🇫🇷
mrcrassi
2026-02-10 07:29:21
(7 months ago)
Triggered Cloudflare WAF (firewallCustom) from NZ.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST meth ...
show more
Triggered Cloudflare WAF (firewallCustom) from NZ.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /owa/auth.owa
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-01-26 19:33:54
(8 months ago)
[27/Jan/2026:06:33:53 +1100] "POST /owa/auth.owa HTTP/1.1" 301 293 "https://owa.[X].[X]/owa/auth/log ...
show more
[27/Jan/2026:06:33:53 +1100] "POST /owa/auth.owa HTTP/1.1" 301 293 "https://owa.[X].[X]/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fowa.[X].[X]%2fowa%2f" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"
show less
Hacking
Web App Attack
