🇺🇸
TPI-Abuse
2026-06-15 20:41:32
(2 hours ago)
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 16:41:24.860707 2026] [security2:error] [pid 18164:tid 18164] [client 45.56.122.18:59118] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.virtualmediamasters.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.virtualmediamasters.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ajBjdEoRpnCAQitnliVIxwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-15 20:41:21
(2 hours ago)
[redacted] 45.56.122.18 - - [15/Jun/2026:22:41:20 +0200] "POST /xmlrpc.php HTTP/1.1" 403 239 "-" "Mo ...
show more
[redacted] 45.56.122.18 - - [15/Jun/2026:22:41:20 +0200] "POST /xmlrpc.php HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0"
[redacted] 45.56.122.18 - - [15/Jun/2026:22:41:20 +0200] "POST /xmlrpc.php HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:53.0) Gecko/20100101 Firefox/53.0"
[redacted] 45.56.122.18 - - [15/Jun/2026:22:41:20 +0200] "POST /xmlrpc.php HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0"
[redacted] 45.56.122.18 - - [15/Jun/2026:22:41:20 +0200] "POST /xmlrpc.php HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0"
[redacted] 45.56.122.18 - - [15/Jun/2026:22:41:20 +0200] "POST /xmlrpc.php HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:40.0) Gecko/20100101 Firefox/40.0"
...
show less
Hacking
Web App Attack
🇩🇪
mondor.ro
2026-06-15 13:34:59
(9 hours ago)
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 45.56.122.18, Reason:[ ...
show more
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 45.56.122.18, Reason:[(XMLRPC) WP XMLPRC Attack 45.56.122.18 (US/United States/45-56-122-18.ip.linodeusercontent.com): 10 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs:
show less
Port Scan
🇺🇸
TPI-Abuse
2026-06-15 04:36:28
(18 hours ago)
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 00:36:25.084333 2026] [security2:error] [pid 11640:tid 11640] [client 45.56.122.18:40444] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||learnserve.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "learnserve.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ai-BSTxs8I5xBp2ebwCKcQAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Jason Howell
2026-06-14 21:58:22
(1 day ago)
45.56.122.18 - - [14/Jun/2026:16:58:21 -0500] "POST /xmlrpc.php HTTP/1.1" 200 2990 "-" "Mozilla/5.0 ...
show more
45.56.122.18 - - [14/Jun/2026:16:58:21 -0500] "POST /xmlrpc.php HTTP/1.1" 200 2990 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0"
45.56.122.18 - - [14/Jun/2026:16:58:21 -0500] "POST /xmlrpc.php HTTP/1.1" 200 2988 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0"
45.56.122.18 - - [14/Jun/2026:16:58:22 -0500] "POST /xmlrpc.php HTTP/1.1" 200 2989 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0"
45.56.122.18 - - [14/Jun/2026:16:58:22 -0500] "POST /xmlrpc.php HTTP/1.1" 200 2988 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0"
45.56.122.18 - - [14/Jun/2026:16:58:22 -0500] "POST /xmlrpc.php HTTP/1.1" 200 2988 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 17:58:50
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 13:58:47.015756 2026] [security2:error] [pid 600:tid 723] [client 45.56.122.18:55274] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||trulyoriginalpurpleoctopus.art|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "trulyoriginalpurpleoctopus.art"] [uri "/wp-json/wp/v2/users"] [unique_id "ai7r12a8o8E0Ek1dBIsqbwAAAkg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 16:09:08
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 12:09:01.674636 2026] [security2:error] [pid 32339:tid 32339] [client 45.56.122.18:51762] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.terfgunclub.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.terfgunclub.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai7SHU3xKG33y1bESRvxOgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
dbmwebdesign
2026-06-14 05:40:21
(1 day ago)
WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 20:59:36
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 16:59:29.582465 2026] [security2:error] [pid 16466:tid 16471] [client 45.56.122.18:58770] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.dwcmachining.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.dwcmachining.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai3EsVW0MF4W3odLxG6AzgAAAIM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-13 08:16:19
(2 days ago)
[redacted] 45.56.122.18 - - [13/Jun/2026:10:16:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mo ...
show more
[redacted] 45.56.122.18 - - [13/Jun/2026:10:16:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0"
[redacted] 45.56.122.18 - - [13/Jun/2026:10:16:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0"
[redacted] 45.56.122.18 - - [13/Jun/2026:10:16:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0"
[redacted] 45.56.122.18 - - [13/Jun/2026:10:16:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:43.0) Gecko/20100101 Firefox/43.0"
[redacted] 45.56.122.18 - - [13/Jun/2026:10:16:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0"
[redacted] 45.56.122.18 - - [13/Jun/202
...
show less
Hacking
Web App Attack
🇨🇦
Dolphi
2026-06-10 18:30:05
(5 days ago)
Excessive POST /xmlrpc.php requests
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 16:03:37
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 12:03:33.185664 2026] [security2:error] [pid 24795:tid 24795] [client 45.56.122.18:48868] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.maffiniandbearce.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.maffiniandbearce.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aimK1ZidlWsI7RfO7Il6lgAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 06:13:00
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 02:12:53.356715 2026] [security2:error] [pid 24134:tid 24137] [client 45.56.122.18:38986] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||victorchiarizia.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "victorchiarizia.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aikAZQ8pF0VXhVXugxV1kgAAAEA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 05:03:19
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 01:03:16.030037 2026] [security2:error] [pid 31103:tid 31103] [client 45.56.122.18:48612] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||imbrasacademic.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "imbrasacademic.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aijwFIUZXUAD0FKDsB7ghQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 23:39:15
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 45.56.122.18 (45-56-122-18.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 19:39:09.585387 2026] [security2:error] [pid 24428:tid 24428] [client 45.56.122.18:42706] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.tonydelov.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.tonydelov.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiikHaXfZycfq6Cgh_o-JQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack