🇺🇸
lcpacs
2026-11-15 17:47:14
UTC ·
(2 hours ago)
Honeypot: credential brute force via xmlrpc (/xmlrpc.php)
Brute-Force
Web App Attack
🇩🇪
4server
2026-11-07 16:33:50
UTC ·
(1 week ago)
[SatNov0717:33:48.0705232026][security2:error][pid2984164:tid2984281][client2a01:4f9:c013:cef2::1:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\|finite\)\|n\(\?:u\(\?:meric\ ...
show more
[SatNov0717:33:48.0705232026][security2:error][pid2984164:tid2984281][client2a01:4f9:c013:cef2::1:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\|finite\)\|n\(\?:u\(\?:meric\|ll\)\|an\)\|\(\?:calla\|dou\)ble\|s\(\?:calar\|tring\)\|f\(\?:inite\|loat\)\|re\(\?:source\|al\)\|l\(\?:ink\|ong\)\|a\(\?:rray\)\?\|object\|bool\)\|set\)\|n\(\?:\(\?:clud\|vok\)e\|t\(\?:div\|val\)\)\|\(\?:mplod\|dat\)e\|conv\)\|s\(\?:t\(\?:r\(\?:\(\?:le\|sp\)n\|...\"atARGS:cyborg.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"582\"][id\"380026\"][rev\"27\"][msg\"Atomicorp.comWAFRules:PHPpayloaddetected\"][data\"echo\(4497\*2086\)\"][severity\"CRITICAL\"][tag\"SQLi\"][tag\"RCE\"][hostname\"casaplusticino.ch\"][uri\"/wp-admin/index.php\"][unique_id\"au9S7ByvP5pb_AlbiU_wNgAAAMc\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 14:07:38
UTC ·
(1 week ago)
(mod_security) mod_security (id:210410) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 09:07:33.378592 2026] [security2:error] [pid 16051:tid 16051] [client 2a01:4f9 ...
show more
(mod_security) mod_security (id:210410) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 09:07:33.378592 2026] [security2:error] [pid 16051:tid 16051] [client 2a01:4f9:c013:cef2::1:40788] ModSecurity: Access denied with code 403 (phase 2). Found 1 byte(s) in REQUEST_HEADERS:Cookie outside range: 1-255. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "95"] [id "210410"] [rev "4"] [msg "COMODO WAF: Invalid character in request||www.crittergetterpestcontrol.com|F|3"] [data "REQUEST_HEADERS:Cookie=hvHi=\\x8f\\x8e\\x98\\xc2\\xaa\\x04\\xb2\\x9d$\\xe7\\x00\\xde\\xbb\\xa9 \\x8b"] [severity "ERROR"] [tag "CWAF"] [tag "Protocol"] [hostname "www.crittergetterpestcontrol.com"] [uri "/wp-author.php"] [unique_id "au8wpQAACisqYaF1Fp1HvQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
london2038.com
2026-11-07 08:31:21
UTC ·
(1 week ago)
Malformed or malicious web request
2a01:4f9:c013:cef2::1 - - [07/Nov/2026:09:31:18 +0100] "POST /wp-content/plugins/wp-photo-album-plus-v2/wppa.php HTTP/1.1" 404 40194 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/15 ...
show more
Malformed or malicious web request
2a01:4f9:c013:cef2::1 - - [07/Nov/2026:09:31:18 +0100] "POST /wp-content/plugins/wp-photo-album-plus-v2/wppa.php HTTP/1.1" 404 40194 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0"
show less
Hacking
Web App Attack
🇩🇪
LRob
2026-10-23 21:20:10
UTC ·
(3 weeks ago)
Web exploit attempt | method: GET | path: /wp-content/plugins/debug-log-manager/assets/css/off.header.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0 | 2026-10-23 21:20 UTC
Hacking
Web App Attack
🇺🇸
lcpacs
2026-10-05 19:13:10
UTC ·
(1 month ago)
Honeypot: credential brute force via xmlrpc (/xmlrpc.php)
Brute-Force
Web App Attack
2026-10-04 23:44:57
UTC ·
(1 month ago)
2026-10-04T23:44:56.105209+00:00 instance-20260804-1025 wordpress(cazseguros.com)[33702]: XML-RPC authentication attempt for unknown user authorninja from 2a01:4f9:c013:cef2::1
...
Web App Attack
2026-10-03 12:08:57
UTC ·
(1 month ago)
2026-10-03T14:08:55.959902+02:00 aion wordpress[905057]: XML-RPC authentication attempt for unknown user wp_service_OVA from 2a01:4f9:c013:cef2::1
...
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-09-20 16:28:15
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 12:28:10.830044 2026] [security2:error] [pid 17875:tid 17875] [client 2a01:4f9 ...
show more
(mod_security) mod_security (id:225170) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 12:28:10.830044 2026] [security2:error] [pid 17875:tid 17875] [client 2a01:4f9:c013:cef2::1:44596] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lockdownclaim.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lockdownclaim.com"] [uri "/wp-json/wp/v2/users"] [unique_id "arAJmt2B7NICY9DCu0WVPAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 15:08:15
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 11:08:11.620717 2026] [security2:error] [pid 2965740:tid 2965740] [client 2a01 ...
show more
(mod_security) mod_security (id:225170) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 11:08:11.620717 2026] [security2:error] [pid 2965740:tid 2965740] [client 2a01:4f9:c013:cef2::1:54774] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hotelausland.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hotelausland.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aq_22zeoozh6sWTOFsVUzAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 08:13:47
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 04:13:42.134543 2026] [security2:error] [pid 31845:tid 31845] [client 2a01:4f9 ...
show more
(mod_security) mod_security (id:225170) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 04:13:42.134543 2026] [security2:error] [pid 31845:tid 31845] [client 2a01:4f9:c013:cef2::1:57214] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.dixiegeek.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.dixiegeek.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aq-VtqetBQ7GYpyOtZokTgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 06:13:23
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 02:13:17.139341 2026] [security2:error] [pid 25562:tid 25562] [client 2a01:4f9 ...
show more
(mod_security) mod_security (id:225170) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 02:13:17.139341 2026] [security2:error] [pid 25562:tid 25562] [client 2a01:4f9:c013:cef2::1:58052] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||twogocamping.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "twogocamping.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aq95fUd4m1eSWAn5BDpw9AAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-20 05:56:21
UTC ·
(1 month ago)
Malicious web request: probing for secrets, traversal or a known exploit path | method: GET | path: /wp-json/wp/v2/users | 2026-09-20 05:56 UTC
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-19 18:31:14
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 14:31:07.263238 2026] [security2:error] [pid 5470:tid 5522] [client 2a01:4f9:c ...
show more
(mod_security) mod_security (id:225170) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 14:31:07.263238 2026] [security2:error] [pid 5470:tid 5522] [client 2a01:4f9:c013:cef2::1:49968] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.lancasterdesignercraftsmen.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.lancasterdesignercraftsmen.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aq7U6_1ybW-r_6Sd_bXYJAAAAYI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-19 16:52:15
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 12:52:09.225541 2026] [security2:error] [pid 1161:tid 1161] [client 2a01:4f9:c ...
show more
(mod_security) mod_security (id:225170) triggered by 2a01:4f9:c013:cef2::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 12:52:09.225541 2026] [security2:error] [pid 1161:tid 1161] [client 2a01:4f9:c013:cef2::1:54480] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.susanleeward.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.susanleeward.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aq69ubz5z0wP1ChX4C5iswAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
