🇩🇪
R.G.
2026-06-12 11:17:39
(6 hours ago)
(WPLOGINorWHATEVER) Get lost please 38.74.206.138 (US/United States/-): 7 in the last 600 secs; Port ...
show more
(WPLOGINorWHATEVER) Get lost please 38.74.206.138 (US/United States/-): 7 in the last 600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 03:46:34
(14 hours ago)
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 23:46:25.975741 2026] [security2:error] [pid 9645:tid 9645] [client 38.74.206.138:51198] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.havenlaneministries.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.havenlaneministries.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiuBERcai7NBqaiWZhD1ZQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-06-12 03:02:26
(15 hours ago)
(wp_login_try) srv101 WP Login Attempt 38.74.206.138 (US/United States/-): 10 in the last 3600 secs; ...
show more
(wp_login_try) srv101 WP Login Attempt 38.74.206.138 (US/United States/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 01:22:16
(16 hours ago)
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 21:22:13.193702 2026] [security2:error] [pid 29688:tid 29688] [client 38.74.206.138:49892] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||twogocamping.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "twogocamping.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aitfRcF62HUvcm_8shL8-QAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-11 23:44:11
(18 hours ago)
CMS (WordPress or Joomla) brute force attempt.
Brute-Force
🇺🇸
TPI-Abuse
2026-06-10 18:05:55
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 14:05:50.732800 2026] [security2:error] [pid 7661:tid 7661] [client 38.74.206.138:34146] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.fiasdesigns.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.fiasdesigns.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aimnfreaxwygarDkFseIqAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Apache
2026-06-10 13:54:26
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (US/United States/-): 5 in the la ...
show more
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (US/United States/-): 5 in the last 300 secs (CF_ENABLE)
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 07:51:23
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 03:51:16.372422 2026] [security2:error] [pid 26836:tid 26836] [client 38.74.206.138:48790] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.tcit.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.tcit.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aifF9BYJnRt33dXEat5KUQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-09 03:57:06
(3 days ago)
[redacted] 38.74.206.138 - - [09/Jun/2026:05:57:03 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "M ...
show more
[redacted] 38.74.206.138 - - [09/Jun/2026:05:57:03 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0"
[redacted] 38.74.206.138 - - [09/Jun/2026:05:57:03 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0"
[redacted] 38.74.206.138 - - [09/Jun/2026:05:57:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:40.0) Gecko/20100101 Firefox/40.0"
[redacted] 38.74.206.138 - - [09/Jun/2026:05:57:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0"
[redacted] 38.74.206.138 - - [09/Jun/2026:05:57:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0"
[redacted] 38.74.206.138 - -
...
show less
Hacking
Web App Attack
🇧🇷
Halux
2026-06-08 21:06:50
(3 days ago)
38.74.206.138 Web Application Firewall multiple violations
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 17:02:56
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 13:02:49.146941 2026] [security2:error] [pid 5836:tid 5836] [client 38.74.206.138:41208] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.inquisitivequincie.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.inquisitivequincie.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aib1uQy9tuyArsZpg2l5hgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
rh24
2026-06-08 16:55:34
(4 days ago)
(wordpress-user-enum) Failed wordpress-user-enum trigger from 38.74.206.138 (US/United States/-): ( ...
show more
(wordpress-user-enum) Failed wordpress-user-enum trigger from 38.74.206.138 (US/United States/-): (CF_ENABLE)
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-06-08 14:44:58
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.74.206.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 10:44:52.826693 2026] [security2:error] [pid 32110:tid 32110] [client 38.74.206.138:43400] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.soundtrax.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.soundtrax.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aibVZJnSJ3h_9MawlnrkIgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
bigwavedave
2026-06-08 09:09:38
(4 days ago)
Wordpress Attack
Web App Attack
🇸🇪
vaia.cloud
2026-06-08 08:53:03
(4 days ago)
trying wp-login.php/xmlrpc.php 87 times in 1 minutes
Brute-Force
Web App Attack