🇩🇪
Packets-Decreaser.NET
2026-10-12 15:28:52
UTC ·
(1 month ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
鬼影233
2026-09-16 20:37:06
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Bad Web Bot
🇳🇱
Site.eu
2026-08-16 19:19:23
UTC ·
(2 months ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇩🇪
Vegascosmetics
2026-08-15 17:55:22
UTC ·
(3 months ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): IP auto-blocked by local security policy.
Hacking
Web App Attack
🇩🇪
grassau.com
2026-08-15 13:50:42
UTC ·
(3 months ago)
(wordpress) Failed wordpress login from 41.90.144.140 (KE/Kenya/Nairobi County/Nairobi/-)
Brute-Force
🇺🇦
Olexiy Backend
2026-08-14 13:06:46
UTC ·
(3 months ago)
41.90.144.140
...
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-14 08:07:52
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 41.90.144.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 04:07:47.504488 2026] [security2:error] [pid 12102:tid 12102] [client 41.90.144.140:1618] Mo ...
show more
(mod_security) mod_security (id:225170) triggered by 41.90.144.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 04:07:47.504488 2026] [security2:error] [pid 12102:tid 12102] [client 41.90.144.140:1618] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||suswastima.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "suswastima.com"] [uri "/wp-json/wp/v2/users"] [unique_id "an7M0wPdD9clur3xMntjqAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-08-13 17:03:23
UTC ·
(3 months ago)
[ThuAug1319:03:21.4379262026][security2:error][pid560204:tid560223][client41.90.144.140:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"96 ...
show more
[ThuAug1319:03:21.4379262026][security2:error][pid560204:tid560223][client41.90.144.140:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"chryptofarm.ch\"][uri\"/xmlrpc.php\"][unique_id\"an342bW3rFxoZ0DZJ6qGvwAAAFA\"]
show less
Port Scan
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-08-12 12:03:23
UTC ·
(3 months ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
chronos
2026-08-12 09:20:26
UTC ·
(3 months ago)
[AUTORAVALT][[12/08/2026 - 06:20:25 -03:00 UTC]
Attack from [Domain Admin]
[41.90.144.140]-[RANGE:41.90.128.0 - 41.90.255.255]
Action: BLocKed
Hacking... Unauthorized attempts to access the server.
Web App Attack -> Attempts to probe for or exploit ...
show more
[AUTORAVALT][[12/08/2026 - 06:20:25 -03:00 UTC]
Attack from [Domain Admin]
[41.90.144.140]-[RANGE:41.90.128.0 - 41.90.255.255]
Action: BLocKed
Hacking... Unauthorized attempts to access the server.
Web App Attack -> Attempts to probe for or exploit installed web applications such as a CMS like WordPress/Drupal, e-commerce solutions, forum software, phpMyAdmin]
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-12 08:23:32
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 41.90.144.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 12 04:23:26.849169 2026] [security2:error] [pid 1224987:tid 1224987] [client 41.90.144.140:6797 ...
show more
(mod_security) mod_security (id:225170) triggered by 41.90.144.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 12 04:23:26.849169 2026] [security2:error] [pid 1224987:tid 1224987] [client 41.90.144.140:6797] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||epetsure.co|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "epetsure.co"] [uri "/wp-json/wp/v2/users"] [unique_id "anwtfnkpYI8N8ihcuh8VywAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
integrantservices.com
2026-08-12 07:40:00
UTC ·
(3 months ago)
(PERMBLOCK) 41.90.144.140 (KE/Kenya/-) has had more than 4 temp blocks
Hacking
🇺🇸
integrantservices.com
2026-08-11 20:10:48
UTC ·
(3 months ago)
(wordpress) Failed wordpress login from 41.90.144.140 (KE/Kenya/-)
Brute-Force
🇳🇴
jad-abuse
2026-08-11 17:02:30
UTC ·
(3 months ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 1 hits.
Brute-Force
Web App Attack
2026-08-10 19:07:47
UTC ·
(3 months ago)
41.90.144.140 - - [10/Aug/2026:21:02:56 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/93.0.0.0 Safari/537.36"
41.90.144.140 - - [10/Aug/2026:21:02:5 ...
show more
41.90.144.140 - - [10/Aug/2026:21:02:56 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/93.0.0.0 Safari/537.36"
41.90.144.140 - - [10/Aug/2026:21:02:59 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/93.0.0.0 Safari/537.36"
41.90.144.140 - - [10/Aug/2026:21:06:22 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36"
41.90.144.140 - - [10/Aug/2026:21:06:25 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36"
41.90.144.140 - - [10/Aug/2026:21:07:44 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari
...
show less
Brute-Force
Web App Attack
