🇮🇩
zam
2026-11-11 05:42:56
UTC ·
(10 hours ago)
27.130.212.222 - - [11/Nov/2026:05:42:54 +0000] 0 ms "POST /wp-login.php HTTP/1.1" 301 277
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 06:50:17
UTC ·
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 27.130.212.222 (27-130-212-222.24.nat.nky2-cgn02.myaisfibre.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 01:50:08.537002 2026] [security2:error] [pid ...
show more
(mod_security) mod_security (id:225170) triggered by 27.130.212.222 (27-130-212-222.24.nat.nky2-cgn02.myaisfibre.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 01:50:08.537002 2026] [security2:error] [pid 30105:tid 30105] [client 27.130.212.222:36028] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||guitarwisdom.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "guitarwisdom.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avK-oOyVHolujsCi7dTkawAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-11-10 00:39:46
UTC ·
(1 day ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.
Bad Web Bot
Web App Attack
2026-11-09 07:00:19
UTC ·
(2 days ago)
| [Dangerous/Thailand] Aggressive IP 27.130.212.222 (~30 hits). Type: DoS Defender- Web server 400 error code
Web App Attack
Hacking
SQL Injection
🇩🇪
maxpower
2026-11-08 17:14:42
UTC ·
(2 days ago)
(wp_fingerprint) REGOLA 6 - WP Exploit Attempt xmlrpc 27.130.212.222 (TH/Thailand/27-130-212-222.24.nat.nky2-cgn02.myaisfibre.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 27.130.212.222 - - [08/Nov/2026: ...
show more
(wp_fingerprint) REGOLA 6 - WP Exploit Attempt xmlrpc 27.130.212.222 (TH/Thailand/27-130-212-222.24.nat.nky2-cgn02.myaisfibre.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 27.130.212.222 - - [08/Nov/2026:18:14:39 +0100] "POST /xmlrpc.php HTTP/2.0" 200 4711 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0" "-" host=keyprint.eu
show less
Port Scan
🇩🇪
LRob
2026-11-08 15:49:56
UTC ·
(3 days ago)
WordPress attack-tool calls | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/155.0.8059.37 Mobile/15E
Web App Attack
Hacking
🇩🇪
big-cloud.nl
2026-11-07 18:55:28
UTC ·
(3 days ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 20:49:43
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 27.130.212.222 (27-130-212-222.24.nat.nky2-cgn02.myaisfibre.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 15:49:36.575995 2026] [security2:error] [pid ...
show more
(mod_security) mod_security (id:225170) triggered by 27.130.212.222 (27-130-212-222.24.nat.nky2-cgn02.myaisfibre.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 15:49:36.575995 2026] [security2:error] [pid 28439:tid 28439] [client 27.130.212.222:39500] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||tgaguide.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tgaguide.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au49YFJUON6Gc_ew9kIMiAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-11-06 01:10:01
UTC ·
(5 days ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇪🇸
pipeline.es
2026-11-05 04:08:25
UTC ·
(6 days ago)
WordPress login brute-force | URL: https://gacetadelturismo.com/wp-login.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-05T04:07:28Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\" ...
show more
WordPress login brute-force | URL: https://gacetadelturismo.com/wp-login.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-05T04:07:28Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\"27.130.212.222\",\"status_code\":503,\"url\":\"https://gacetadelturismo.com/wp-login.php\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0\",\"wfid\":4747292} | ASN: Triple T Broadband Public Company Limited | Country: TH
show less
Brute-Force
