2026-05-30 03:44:08
(6 days ago)
Rate limit bad session: 3 in 2s | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ( ...
show more
Rate limit bad session: 3 in 2s | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 CCleaner/130.0.0.0 | (Magento Site) (Botnet activity attributed to: Angara Technologies Group / mikhail...
show less
Hacking
🇺🇸
TPI-Abuse
2026-04-30 22:40:08
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 31.134.4.109 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 31.134.4.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 18:40:03.870680 2026] [security2:error] [pid 3100:tid 3123] [client 31.134.4.109:28583] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||whitecrosslibrary.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "whitecrosslibrary.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afPaQ74BCOhgUAj7SgA8MAAAANU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-28 14:43:32
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 31.134.4.109 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 31.134.4.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 10:43:26.594443 2026] [security2:error] [pid 23043:tid 23043] [client 31.134.4.109:50693] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||loriarsenault.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "loriarsenault.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afDHjrPPjUfDN3cyKlQifAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-25 16:39:15
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 31.134.4.109 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 31.134.4.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 25 12:39:08.453693 2026] [security2:error] [pid 7456:tid 7456] [client 31.134.4.109:58249] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||321q.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "321q.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aezuLM20pbEa9nAz_hJcLwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-23 18:16:38
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 31.134.4.109 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 31.134.4.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 23 14:16:31.569524 2026] [security2:error] [pid 29723:tid 29723] [client 31.134.4.109:42663] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||primacomm.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "primacomm.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeph_7LScW8EtLtg_mLYtwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-19 00:45:06
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 31.134.4.109 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 31.134.4.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 18 20:44:57.155753 2026] [security2:error] [pid 2292382:tid 2292382] [client 31.134.4.109:18831] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.evolute.io|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.evolute.io"] [uri "/wp-json/wp/v2/users"] [unique_id "aeQlif4ghISE6TxospmZDQAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
Burayot
2026-03-23 22:39:08
(2 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 31.134.4.109 (SC/Seychelles/-): 1 i ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 31.134.4.109 (SC/Seychelles/-): 1 in the last 3600 secs
show less
Web App Attack
🇨🇭
backslash
2026-02-04 03:20:30
(4 months ago)
block ruleset 798ECF92F12ADC636D3520C2890AF17ADEFDE3BE
Bad Web Bot