🇺🇸
TPI-Abuse
2026-10-21 21:40:30
(13 hours ago)
(mod_security) mod_security (id:210350) triggered by 45.140.206.82 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 45.140.206.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 17:40:24.273085 2026] [security2:error] [pid 15576:tid 15576] [client 45.140.206.82:41437] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.jesuspuzzle.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.jesuspuzzle.com"] [uri "/jesuspuzzle/rfset1.htm"] [unique_id "atkxSJMBftQy3s_8JdG7OgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-24 00:37:24
(4 weeks ago)
[ti-01sc] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpr ...
show more
[ti-01sc] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 45.140.206.82 - - [24/Sep/2026:02:36:39 +0200] "POST /xmlrpc.php HTTP/2.0" 403 87 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15"
45.140.206.82 - - [24/Sep/2026:02:36:56 +0200] "POST /wp-login.php HTTP/2.0" 200 4486 "https://www.nieuwsvoordietisten.nl/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15"
45.140.206.82 - - [24/Sep/2026:02:36:59 +0200] "POST /xmlrpc.php HTTP/2.0" 403 87 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15"
45.140.206.82 - - [24/Se
...
show less
Brute-Force
Web App Attack
🇫🇮
bittiguru.fi
2026-09-23 06:09:33
(4 weeks ago)
45.140.206.82 - [23/Sep/2026:09:08:42 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 ...
show more
45.140.206.82 - [23/Sep/2026:09:08:42 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" "4.66"
45.140.206.82 - [23/Sep/2026:09:09:33 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "4.66"
...
show less
Hacking
Brute-Force
Web App Attack
🇩🇪
LRob
2026-09-22 14:33:09
(4 weeks ago)
This address sends abusive requests to WordPress sites we host: user enumeration through the REST AP ...
show more
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack tools, blocked on sight. Please check the machine behind it. | method: POST | path: /xmlrpc.php | 2026-09-22 14:33 UTC
show less
Web App Attack
Hacking
🇨🇿
Countryman
2026-09-14 00:10:01
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇸🇪
OnTheEdge
2026-09-08 13:08:47
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇺🇸
nationaleventpros.com
2026-09-05 06:51:14
(1 month ago)
WordPress login attempt
Brute-Force
2026-09-04 22:22:35
(1 month ago)
FPROCO WEBEXPLOIT 45.140.206.82 (45.140.206.82)
Web App Attack
🇮🇹
VHosting
2026-09-03 19:15:03
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-31 02:33:50
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 45.140.206.82 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 45.140.206.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 30 22:33:45.506482 2026] [security2:error] [pid 16094:tid 16094] [client 45.140.206.82:51913] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.domainexecs.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.domainexecs.com"] [uri "/"] [unique_id "apToCWBuAZoEFB1drZi86AAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-24 16:11:01
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 45.140.206.82 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 45.140.206.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 12:10:53.769284 2026] [security2:error] [pid 15801:tid 15801] [client 45.140.206.82:47771] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||architech.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "architech.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoxtDejnVuS6A_Nt_X1sJAAAAAY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-11 00:30:33
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 45.140.206.82 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 45.140.206.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 20:30:29.492573 2026] [security2:error] [pid 2493476:tid 2493476] [client 45.140.206.82:14291] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||helik.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "helik.com"] [uri "/wp-json/wp/v2/users"] [unique_id "anptJQ0OpMNkHgPT4y7iKwAAAAQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-06 03:26:38
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 45.140.206.82 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 45.140.206.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 05 23:26:34.599735 2026] [security2:error] [pid 20183:tid 20183] [client 45.140.206.82:51965] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ruizpuche.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ruizpuche.com"] [uri "/wp-json/wp/v2/users"] [unique_id "anP-6nP-4ow-kvZpiZulMQAAAA0"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-06-29 08:35:32
(3 months ago)
Fail2Ban banned 45.140.206.82 for security violations in jail wp-armour. Log: 2026/06/29 08:35:32 [e ...
show more
Fail2Ban banned 45.140.206.82 for security violations in jail wp-armour. Log: 2026/06/29 08:35:32 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 45.140.206.82 | Target: wplogin" , client: 45.140.206.82, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇫🇷
Tilellit.PRO
2026-06-27 16:08:25
(3 months ago)
Fail2Ban banned 45.140.206.82 for security violations in jail wp-armour. Log: 2026/06/27 16:08:25 [e ...
show more
Fail2Ban banned 45.140.206.82 for security violations in jail wp-armour. Log: 2026/06/27 16:08:25 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 45.140.206.82 | Target: wplogin" , client: 45.140.206.82, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam