🇦🇺
aranguren.org
2026-06-04 00:21:36
(1 month ago)
45.91.21.2 - - [04/Jun/2026:10:21:34 +1000] "GET /update/ HTTP/1.1" 404 996 "-" "Mozilla/5.0 (Window ...
show more
45.91.21.2 - - [04/Jun/2026:10:21:34 +1000] "GET /update/ HTTP/1.1" 404 996 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0"
45.91.21.2 - - [04/Jun/2026:10:21:34 +1000] "GET /wp-content/ HTTP/1.1" 404 996 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36"
45.91.21.2 - - [04/Jun/2026:10:21:34 +1000] "GET /wp-admin/maint/ HTTP/1.1" 404 996 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:79.0) Gecko/20100101 Firefox/79.0"
45.91.21.2 - - [04/Jun/2026:10:21:35 +1000] "GET /themes/zMousse/ HTTP/1.1" 404 996 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0"
45.91.21.2 - - [04/Jun/2026:10:21:35 +1000] "GET /wp-content/plugins/ubh/ HTTP/1.1" 404 996 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0"
45.91.21.2 - - [04/Jun/2026:10:21:35 +1000] "GET /wp-admin/images/ HTTP/1.1" 404 996 "-" "Mozilla/5.0 (Windows NT 10.0; Win64;
...
show less
Bad Web Bot
🇺🇦
URAN Publishing Service
2026-05-09 15:50:54
(2 months ago)
45.91.21.2 - - [09/May/2026:18:50:51 +0300] "GET /wp-content/plugins/enhanced-text-widget/analyst/sr ...
show more
45.91.21.2 - - [09/May/2026:18:50:51 +0300] "GET /wp-content/plugins/enhanced-text-widget/analyst/src/403x.php HTTP/1.1" 404 707 "-" "Go-http-client/1.1"
45.91.21.2 - - [09/May/2026:18:50:54 +0300] "GET /wp-content/plugins/semrush/x.php HTTP/1.1" 404 707 "-" "Go-http-client/1.1"
...
show less
Web App Attack
🇳🇿
Antinson
2026-05-03 07:48:14
(2 months ago)
Scraping with a high error ratio and request rate
Bad Web Bot
🇺🇸
interbiznw.com
2026-05-02 21:10:11
(2 months ago)
malicious-web-requests-vulnerability-scanning
Hacking
Brute-Force
Exploited Host
Web App Attack
🇩🇪
EGP Abuse Dept
2026-04-18 11:39:49
(3 months ago)
Scanning for web/db/file exploits on workshopfactory.nu
SQL Injection
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-04-18 03:21:00
(3 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇩🇪
outputblog.de
2026-04-17 18:50:17
(3 months ago)
apache-wp-probephp
Port Scan
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-04-14 23:46:40
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 45.91.21.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 45.91.21.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 14 19:46:33.721094 2026] [security2:error] [pid 2819336:tid 2819336] [client 45.91.21.2:29081] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||blublk.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "blublk.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad7R2VvcmpqGoMTC4Pg2JAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-14 22:44:03
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 45.91.21.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 45.91.21.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 14 18:43:56.008870 2026] [security2:error] [pid 3777187:tid 3777187] [client 45.91.21.2:63125] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||blaslandsporthorses.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "blaslandsporthorses.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad7DLBrmxGVPxeaFSj7xYQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-14 19:31:25
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 45.91.21.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 45.91.21.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 14 15:31:21.175830 2026] [security2:error] [pid 1233486:tid 1233486] [client 45.91.21.2:49819] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bigholegolf.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bigholegolf.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad6WCZoVJGx3etVSzBmtxwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-04-14 16:09:58
(3 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇩🇪
big-cloud.nl
2026-04-12 21:45:16
(3 months ago)
Try to access /xmlrpc.php
Web App Attack
🇫🇷
masterguru
2026-04-03 12:46:32
(3 months ago)
BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (110 ...
show more
BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (1100000-196)
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-03-11 20:50:52
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 45.91.21.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210730) triggered by 45.91.21.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 16:50:45.013348 2026] [security2:error] [pid 6660:tid 6660] [client 45.91.21.2:23773] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||qualityelevatorcabs.com|F|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "qualityelevatorcabs.com"] [uri "/backups/wallet.dat"] [unique_id "abHVpe_sfjbRv5061LomcgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
r3versedk
2026-03-11 09:08:53
(4 months ago)
🛡️ Automated Threat Report from maxjensen.dk
🎯 Attack Type: Botnet Fingerprint
🚨 Severity: CRITICAL ...
show more
🛡️ Automated Threat Report from maxjensen.dk
🎯 Attack Type: Botnet Fingerprint
🚨 Severity: CRITICAL
📊 Threat Score: 95/100
📈 Total Attacks: 389 (database verified, seen over today)
🔍 Peak Score: 95/100
🎯 Common Types: Botnet Fingerprint(1x)
🔍 Fingerprint: 9f96b00ce11bc787
🤖 AI/ML: 🤝 Multi-Model Consensus (neural-network, q-learning, gpt) - 🧠 NN (55%): throttle (94.9%) | 🎮 QL (23%): block (75.0%) | 🤖 Claude (23%): monitor (70.0%) | ⚖️ dynamic+boosted weights...
Detected: 2026-03-11T09:08:53.322Z
show less
Bad Web Bot