🇳🇱
Mangelot Hosting
2026-11-05 01:02:44
(4 hours ago)
(wp_admin_scan) srv202 Restricted wp-admin access 2803:e140:1f1:ee90:2649:8839:dec8:86ae (PY/Paraguay/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
2026-11-04 12:34:01
(17 hours ago)
"POST /wp-login.php HTTP/1.1"
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 09:42:57
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 04:42:51.335504 2026] [security2:error] [pid 2123:tid 2123] [ ...
show more
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 04:42:51.335504 2026] [security2:error] [pid 2123:tid 2123] [client 2803:e140:1f1:ee90:2649:8839:dec8:86ae:36316] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||secuencia.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "secuencia.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aumsm7rbHl_Y2PmR9jf89wAAAAM"], referer: https://secuencia.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-02 12:51:04
(2 days ago)
(wp_admin_scan) srv202 Restricted wp-admin access 2803:e140:1f1:ee90:2649:8839:dec8:86ae (PY/Paraguay/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 04:58:45
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 23:58:42.894619 2026] [security2:error] [pid 16600:tid 16600] ...
show more
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 23:58:42.894619 2026] [security2:error] [pid 16600:tid 16600] [client 2803:e140:1f1:ee90:2649:8839:dec8:86ae:54404] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thestardance.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thestardance.com"] [uri "/wp-json/wp/v2/users"] [unique_id "augYgrtcO_tsaaITxzhCvAAAAAU"], referer: https://thestardance.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
JimArchon72
2026-10-29 10:25:01
(6 days ago)
2026/10/29 10:24:53 "GET /wp-admin/ HTTP/1.1"
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 23:36:35
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 19:36:31.745576 2026] [security2:error] [pid 11744:tid 11744] ...
show more
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 19:36:31.745576 2026] [security2:error] [pid 11744:tid 11744] [client 2803:e140:1f1:ee90:2649:8839:dec8:86ae:40632] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mchen-arch.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mchen-arch.com"] [uri "/wp-json/wp/v2/users"] [unique_id "auKG_0p-26YKoflCWpYSYgAAABg"], referer: https://mchen-arch.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 23:10:41
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 19:10:35.244597 2026] [security2:error] [pid 10004:tid 10004] ...
show more
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 19:10:35.244597 2026] [security2:error] [pid 10004:tid 10004] [client 2803:e140:1f1:ee90:2649:8839:dec8:86ae:54968] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gonzalez.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gonzalez.com"] [uri "/wp-json/wp/v2/users"] [unique_id "auKA6xctU_RFWgN3-aqK6QAAAAA"], referer: https://gonzalez.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 09:45:24
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 05:45:18.050863 2026] [security2:error] [pid 12850:tid 12850] ...
show more
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 05:45:18.050863 2026] [security2:error] [pid 12850:tid 12850] [client 2803:e140:1f1:ee90:2649:8839:dec8:86ae:45366] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jmms.mx|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jmms.mx"] [uri "/wp-json/wp/v2/users"] [unique_id "auByrmTMCRcdZ_EOj2J4wQAAACA"], referer: https://jmms.mx
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 19:55:30
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 15:55:25.570660 2026] [security2:error] [pid 30076:tid 30076] ...
show more
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 15:55:25.570660 2026] [security2:error] [pid 30076:tid 30076] [client 2803:e140:1f1:ee90:2649:8839:dec8:86ae:58998] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gulftelecom.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gulftelecom.com"] [uri "/wp-json/wp/v2/users"] [unique_id "at0NLcIDjCJ2_Dcqs5aa2QAAABA"], referer: https://gulftelecom.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 11:37:21
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 07:37:17.607108 2026] [security2:error] [pid 18360:tid 18360] ...
show more
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 07:37:17.607108 2026] [security2:error] [pid 18360:tid 18360] [client 2803:e140:1f1:ee90:2649:8839:dec8:86ae:47264] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||liberlibro.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "liberlibro.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atyYbW5n46Lx0UxLyYdohgAAAB4"], referer: https://liberlibro.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 21:46:24
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 17:46:19.815921 2026] [security2:error] [pid 517:tid 533] [cl ...
show more
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 17:46:19.815921 2026] [security2:error] [pid 517:tid 533] [client 2803:e140:1f1:ee90:2649:8839:dec8:86ae:55202] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||laradioactivitat.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "laradioactivitat.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atqEK_TkBLl3MDGdU-jlbwAAAAc"], referer: https://laradioactivitat.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 20:37:13
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:37:08.276969 2026] [security2:error] [pid 13520:tid 13520] ...
show more
(mod_security) mod_security (id:225170) triggered by 2803:e140:1f1:ee90:2649:8839:dec8:86ae (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:37:08.276969 2026] [security2:error] [pid 13520:tid 13520] [client 2803:e140:1f1:ee90:2649:8839:dec8:86ae:53122] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||theproducers.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "theproducers.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atkidMbI7MISTEEuPHEwgAAAAAU"], referer: https://theproducers.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
KiekerJan
2026-10-21 13:57:45
(2 weeks ago)
2803:e140:1f1:ee90:2649:8839:dec8:86ae - - [21/Oct/2026:15:57:44 +0200] "POST /wp-login.php HTTP/1.1" 404 181 "https://noavandewijdeven.nl/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0. ...
show more
2803:e140:1f1:ee90:2649:8839:dec8:86ae - - [21/Oct/2026:15:57:44 +0200] "POST /wp-login.php HTTP/1.1" 404 181 "https://noavandewijdeven.nl/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
2803:e140:1f1:ee90:2649:8839:dec8:86ae - - [21/Oct/2026:15:57:44 +0200] "GET /wp-admin/ HTTP/1.1" 404 181 "https://noavandewijdeven.nl/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇳🇱
Mangelot Hosting
2026-10-21 03:39:46
(2 weeks ago)
(wp_admin_scan) srv202 Restricted wp-admin access 2803:e140:1f1:ee90:2649:8839:dec8:86ae (PY/Paraguay/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
