🇺🇸
TPI-Abuse
2026-09-23 07:37:37
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 03:37:33.715727 2026] [security2:error] [pid 19331:tid 19331] [client 37.60.246.205:49312] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.store.newmooncafe.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.store.newmooncafe.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "arOBvYrOE7rqShz6oisodwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 05:51:46
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 01:51:42.621438 2026] [security2:error] [pid 12987:tid 12987] [client 37.60.246.205:33886] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||k2servicesinc.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "k2servicesinc.net"] [uri "/wp-json/wp/v2/users/me"] [unique_id "arNo7rfTxteg_A8MMKROrAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 05:36:30
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 01:36:23.650076 2026] [security2:error] [pid 20957:tid 21179] [client 37.60.246.205:35098] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||inal.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "inal.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "arNlVz_19HIxds7uqMZH6QAAAcg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇽
octageeks.com
2026-09-23 04:08:09
(1 day ago)
Wordpress malicious attack:[octaflood]
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 02:05:42
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 22:05:36.513729 2026] [security2:error] [pid 2220:tid 2220] [client 37.60.246.205:60510] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||josephshv.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "josephshv.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "arMz8KUjVMeV_7NcNeviggAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 10:06:04
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 06:05:56.679533 2026] [security2:error] [pid 20833:tid 20833] [client 37.60.246.205:50880] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lusineweb.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lusineweb.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "arJTBImufgGU5B3t-Y-94wAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-09-22 09:57:08
(2 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇩🇪
LRob
2026-09-22 09:35:26
(2 days ago)
This address requests our sites over plain http, is answered with a redirect to https, and never fol ...
show more
This address requests our sites over plain http, is answered with a redirect to https, and never follows it — over and over. A browser follows redirects; a scanner enumerating hosts does not. It reads nothing it asks for and only loads the server; blocked. Please check what runs on this address. | method: GET | path: /wp-admin/ | 2026-09-22 09:35 UTC
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-22 09:06:21
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 05:06:17.663198 2026] [security2:error] [pid 15672:tid 15672] [client 37.60.246.205:42122] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||glendaleheritage.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "glendaleheritage.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "arJFCei01lj540pI8QF-fgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
stinpriza
2026-09-22 06:50:33
(2 days ago)
Web App Attack
Web App Attack
🇩🇪
LRob
2026-09-22 06:41:45
(2 days ago)
This address sends abusive requests to WordPress sites we host: user enumeration through the REST AP ...
show more
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack tools, blocked on sight. Please check the machine behind it. | method: POST | path: /xmlrpc.php | 2026-09-22 06:41 UTC
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-17 05:02:38
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 37.60.246.205 (ns1.lightvoicehosting.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 01:02:32.773035 2026] [security2:error] [pid 20180:tid 20180] [client 37.60.246.205:45554] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.superlamb.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.superlamb.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqt0aDD_CJcmTCls0sXBNAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
octageeks.com
2026-04-09 04:06:25
(5 months ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇩🇪
LRob
2026-04-06 04:30:07
(5 months ago)
WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail
Brute-Force
Web App Attack
🇺🇸
octageeks.com
2026-04-06 04:07:25
(5 months ago)
Wordpress malicious attack:[octawp]
Web App Attack
