🇺🇸
TPI-Abuse
2026-08-25 07:32:30
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 34.186.103.78 (78.103.186.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:225170) triggered by 34.186.103.78 (78.103.186.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 03:32:22.045470 2026] [security2:error] [pid 31421:tid 31496] [client 34.186.103.78:53853] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.iancaird.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.iancaird.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ao1FBlrFaI3AaEccxRS57wAAAgY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-08-25 07:03:30
(2 weeks ago)
10 attempts against mh-misc-ban on ficus
Web App Attack
🇮🇹
VHosting
2026-08-25 07:00:10
(2 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
Anonymous
2026-08-25 06:54:51
(2 weeks ago)
[redacted] 34.186.103.78 - - [25/Aug/2026:08:54:45 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" " ...
show more
[redacted] 34.186.103.78 - - [25/Aug/2026:08:54:45 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.186.103.78 - - [25/Aug/2026:08:54:45 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.186.103.78 - - [25/Aug/2026:08:54:46 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.186.103.78 - - [25/Aug/2026:08:54:46 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.186.103.78 - - [25/Aug/2026:08:54:47 +0200] "POST //x
...
show less
Hacking
Web App Attack
🇳🇴
jad-abuse
2026-08-25 06:44:39
(2 weeks ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. O ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 17 hits.
show less
Brute-Force
Web App Attack
Anonymous
2026-08-25 06:38:26
(2 weeks ago)
Blocked by ModSec and CSF
Port Scan
🇺🇸
TPI-Abuse
2026-08-25 06:24:19
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 34.186.103.78 (78.103.186.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:225170) triggered by 34.186.103.78 (78.103.186.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 02:24:14.215491 2026] [security2:error] [pid 11354:tid 11422] [client 34.186.103.78:64715] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||honeyled.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "honeyled.com"] [uri "/blog/wp-json/wp/v2/users/"] [unique_id "ao01DpmGklRiCgP0c7oU2wAAAM8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
loebas
2026-08-25 06:19:49
(2 weeks ago)
34.186.103.78 - - [25/Aug/2026:08:19:47 +0200] "GET //wp-includes/ID3/license.txt HTTP/1.1" 404 8491 ...
show more
34.186.103.78 - - [25/Aug/2026:08:19:47 +0200] "GET //wp-includes/ID3/license.txt HTTP/1.1" 404 8491 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.186.103.78 - - [25/Aug/2026:08:19:47 +0200] "GET //feed/ HTTP/1.1" 404 3515 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.186.103.78 - - [25/Aug/2026:08:19:47 +0200] "GET //xmlrpc.php?rsd HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.186.103.78 - - [25/Aug/2026:08:19:47 +0200] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 3515 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.186.103.78 - - [25/Aug/2026:08:19:48 +0200] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 3515 "-" "Mozilla/5.0 (Windows NT 10.0; Win
...
show less
Bad Web Bot
Web App Attack
🇦🇺
Klaverstyn
2026-08-25 06:19:46
(2 weeks ago)
Excessive HTTP request rate
Web App Attack