🇺🇸
TPI-Abuse
2026-05-30 07:14:08
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 45.66.209.35 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 45.66.209.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 30 03:14:05.485901 2026] [security2:error] [pid 11727:tid 11727] [client 45.66.209.35:52051] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thestardance.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thestardance.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahqOPQB-q2Zs5Q-Qwo8c3QAAAAU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-05-21 15:46:11
(2 weeks ago)
Web password guessing
Brute-Force
🇺🇸
TPI-Abuse
2026-05-18 14:05:50
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 45.66.209.35 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 45.66.209.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 10:05:43.295249 2026] [security2:error] [pid 11808:tid 11808] [client 45.66.209.35:24187] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ladylilacfarm.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ladylilacfarm.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agsct3J9F_otTlzsS8WBjQAAAAA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nationaleventpros.com
2026-05-14 19:58:48
(3 weeks ago)
WordPress login attempt
Brute-Force
🇺🇸
TPI-Abuse
2026-04-04 16:59:02
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 45.66.209.35 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 45.66.209.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 12:58:57.976224 2026] [security2:error] [pid 17053:tid 17053] [client 45.66.209.35:37073] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jblaw.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jblaw.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adFDURfRSp5308j-RXs1XAAAABU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
el-brujo
2026-04-04 15:30:59
(2 months ago)
Cloudflare WAF: Request Path: /xmlrpc.php Request Query: Host: elhacker.net userAgent: Apache-HttpC ...
show more
Cloudflare WAF: Request Path: /xmlrpc.php Request Query: Host: elhacker.net userAgent: Apache-HttpClient/4.5.13 (Java/11.0.30) Action: managed_challenge Source: firewallManaged ASN Description: BTTGROUP-AS Country: US Method: POST Timestamp: 2026-04-04T15:30:59Z ruleId: 5de7edfa648c4d6891dc3e7f84534ffa. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB).
show less
Hacking
SQL Injection
Web App Attack
🇪🇸
el-brujo
2026-04-04 15:30:48
(2 months ago)
[Sat Apr 04 17:30:43.280444 2026] [proxy_fcgi:error] [pid 62694:tid 63253] [remote 45.66.209.35:0] A ...
show more
[Sat Apr 04 17:30:43.280444 2026] [proxy_fcgi:error] [pid 62694:tid 63253] [remote 45.66.209.35:0] AH01071: Got error 'Primary script unknown\n', referer: https://www.google.com
[Sat Apr 04 17:30:47.734084 2026] [proxy_fcgi:error] [pid 62736:tid 63293] [remote 45.66.209.35:0] AH01071: Got error 'Primary script unknown\n', referer: https://www.google.com
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 01:04:58
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 45.66.209.35 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 45.66.209.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 21:04:53.679972 2026] [security2:error] [pid 31740:tid 31740] [client 45.66.209.35:18571] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jmgrigg.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jmgrigg.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ac8SNezbF8ioJHGhVzEgPgAAAAQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-02 23:28:07
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 45.66.209.35 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 45.66.209.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 19:27:59.805082 2026] [security2:error] [pid 30360:tid 30360] [client 45.66.209.35:15241] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cs-mall.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cs-mall.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ac77f8SBYBjxyieCdjELbAAAABk"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-03-30 07:32:26
(2 months ago)
Web password guessing
Brute-Force
2025-09-01 00:08:36
(9 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-06-17 15:53:02
(11 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇨🇦
wil.com
2024-10-29 08:27:52
(1 year ago)
GlobalProtect login attempts with user ASPNET.
VPN IP
Brute-Force
2024-09-29 15:50:08
(1 year ago)
Automatic report - Vulnerability scan
/RDWeb/Pages/en-US/login.aspx
Web App Attack
🇩🇪
Savvii
2022-09-14 18:15:11
(3 years ago)
20 attempts against mh-misbehave-ban on web
Brute-Force
Bad Web Bot
Web App Attack