🇨🇿
Countryman
2026-09-13 00:10:01
(3 weeks ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-09-11 00:23:37
(3 weeks ago)
Unauthorized VPN login attempts: 2 attempts were recorded from 45.159.20.125
2026-09-11T01:49:31+02: ...
show more
Unauthorized VPN login attempts: 2 attempts were recorded from 45.159.20.125
2026-09-11T01:49:31+02:00 vpn Access-Reject 'ftvpn' station: 45.159.20.125 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-11T01:52:19+02:00 vpn Access-Reject 'Lasse' station: 45.159.20.125 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇩🇪
4server
2026-09-03 00:01:43
(1 month ago)
[ThuSep0302:01:39.7371972026][security2:error][pid2131784:tid2131896][client45.159.20.125:0]ModSecur ...
show more
[ThuSep0302:01:39.7371972026][security2:error][pid2131784:tid2131896][client45.159.20.125:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"alessandrolucchini.ch\"][uri\"/xmlrpc.php\"][unique_id\"api44z_BB0w8EdTuE_a0UAAAANA\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
kosada.com
2026-09-01 00:55:12
(1 month ago)
Web password guessing
Brute-Force
🇺🇸
kosada.com
2026-08-18 03:36:19
(1 month ago)
Web password guessing
Brute-Force
🇪🇨
icp77
2026-08-17 14:41:00
(1 month ago)
Abuse DDoS
DDoS Attack
Port Scan
Brute-Force
Exploited Host
Web App Attack
SSH
FTP Brute-Force
Hacking
SQL Injection
🇺🇸
kosada.com
2026-08-05 01:48:55
(2 months ago)
Web password guessing
Brute-Force
🇺🇸
TPI-Abuse
2026-08-04 01:37:24
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 45.159.20.125 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 45.159.20.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 21:37:15.767315 2026] [security2:error] [pid 815705:tid 815705] [client 45.159.20.125:44573] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||visco174.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "visco174.com"] [uri "/wp-json/wp/v2/users"] [unique_id "anFCS6pmAhVWi4RpWWPz1gAAAAc"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-14 11:58:24
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 45.159.20.125 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 45.159.20.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 07:58:20.137841 2026] [security2:error] [pid 20592:tid 20592] [client 45.159.20.125:23581] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||idahouspsa.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "idahouspsa.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alYkXGGe2pCOVO4zzizpjQAAAA0"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-08 11:30:40
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 45.159.20.125 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 45.159.20.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 07:30:34.514678 2026] [security2:error] [pid 3564:tid 3564] [client 45.159.20.125:35553] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mahtani.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mahtani.org"] [uri "/wp-json/wp/v2/users"] [unique_id "ak402niUVDtOyCeTvA8eFQAAAAU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-06-29 16:44:59
(3 months ago)
Fail2Ban banned 45.159.20.125 for security violations in jail wp-armour. Log: 2026/06/29 16:44:59 [e ...
show more
Fail2Ban banned 45.159.20.125 for security violations in jail wp-armour. Log: 2026/06/29 16:44:59 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 45.159.20.125 | Target: wplogin" , client: 45.159.20.125, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇫🇷
Tilellit.PRO
2026-06-27 07:06:15
(3 months ago)
Fail2Ban banned 45.159.20.125 for security violations in jail wp-armour. Log: 2026/06/27 07:06:15 [e ...
show more
Fail2Ban banned 45.159.20.125 for security violations in jail wp-armour. Log: 2026/06/27 07:06:15 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 45.159.20.125 | Target: wplogin" , client: 45.159.20.125, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇺🇸
TPI-Abuse
2026-06-21 04:03:51
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 45.159.20.125 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 45.159.20.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 00:03:46.978466 2026] [security2:error] [pid 32648:tid 32648] [client 45.159.20.125:62177] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||frootloops.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "frootloops.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ajdiolnjIFh4qrgFR4JtbwAAABI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-05-22 16:29:54
(4 months ago)
Web password guessing
Brute-Force
🇪🇸
el-brujo
2026-02-05 13:35:51
(7 months ago)
Cloudflare WAF: Request Path: /xmlrpc.php Request Query: Host: foro.elhacker.net userAgent: Mozilla ...
show more
Cloudflare WAF: Request Path: /xmlrpc.php Request Query: Host: foro.elhacker.net userAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:146.0) Gecko/20100101 Firefox/146.0 Action: managed_challenge Source: firewallManaged ASN Description: BTTGROUP-AS Country: US Method: POST Timestamp: 2026-02-05T13:35:51Z ruleId: 5de7edfa648c4d6891dc3e7f84534ffa. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB).
show less
Hacking
SQL Injection
Web App Attack
