🇬🇧
foxxelabs
2026-11-11 09:30:55
UTC ·
(15 hours ago)
Automated report from FoxxeLabs Sentinel. Path probed: /wp-login.php | Project: anseo | Reason(s): Known exploit path: /wp-login.php | User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:148.0) Gecko/20100101 Firefox/148.0
Web App Attack
🇩🇪
big-cloud.nl
2026-11-11 09:20:23
UTC ·
(16 hours ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 02:35:02
UTC ·
(22 hours ago)
(mod_security) mod_security (id:225170) triggered by 46.252.245.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 21:34:57.293476 2026] [security2:error] [pid 23430:tid 23430] [client 46.252.245.86:51634] M ...
show more
(mod_security) mod_security (id:225170) triggered by 46.252.245.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 21:34:57.293476 2026] [security2:error] [pid 23430:tid 23430] [client 46.252.245.86:51634] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||northfortworthalliance.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "northfortworthalliance.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avPUUapf-2o-jww3s8nvXwAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
lostswordfish.com
2026-11-06 05:18:04
UTC ·
(5 days ago)
Wordfence waf block on registrymatters
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 07:31:45
UTC ·
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 46.252.245.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 02:31:37.672698 2026] [security2:error] [pid 500039:tid 500089] [client 46.252.245.86:40894] ...
show more
(mod_security) mod_security (id:225170) triggered by 46.252.245.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 02:31:37.672698 2026] [security2:error] [pid 500039:tid 500089] [client 46.252.245.86:40894] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||danelandia.aafm.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "danelandia.aafm.us"] [uri "/wp-json/wp/v2/users/me"] [unique_id "auww2a8SdyLJJG6L5jxMwQAAAdA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-11-05 01:10:01
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-11-03 08:33:14
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 46.252.245.86
2026-11-03T09:23:59+0100 vpn Access-Reject station: 46.252.245.86
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-11-03 01:10:02
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
lp
2026-11-02 23:03:45
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 46.252.245.86
2026-11-02T23:48:49+0100 vpn Access-Reject station: 46.252.245.86
Brute-Force
Web App Attack
🇩🇪
Hazzard
2026-10-20 13:34:29
UTC ·
(3 weeks ago)
(wordpress) Failed wordpress login from 46.252.245.86 (RU/Russia/-/-/-/[redacted]): (CF_ENABLE)
Brute-Force
2026-10-19 04:45:27
UTC ·
(3 weeks ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Offpeak: Sessionless Catalog Access Blocked: /brands/cisco/collaboration/telepresence/shopby/iptel_certified-sip/manufacturer-cisco/product_vc_mcu-do_6_abonentov/product_vc_type-bol_peregovornaja-soft_klient.html | UA: Mozilla/5.0 (compatible; MSIE 6.0; Windows CE; Trident/4.0) | (Magento Site)
show less
Hacking
Bad Web Bot
🇲🇽
octageeks.com
2026-10-18 04:13:01
UTC ·
(3 weeks ago)
Wordpress malicious attack:[octaflood]
Web App Attack
🇺🇸
agenciahypelab.com.br
2026-10-17 08:19:07
UTC ·
(3 weeks ago)
WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-10-17 07:40:49
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 46.252.245.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 03:40:43.758468 2026] [security2:error] [pid 12923:tid 12923] [client 46.252.245.86:40172] M ...
show more
(mod_security) mod_security (id:225170) triggered by 46.252.245.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 03:40:43.758468 2026] [security2:error] [pid 12923:tid 12923] [client 46.252.245.86:40172] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||llew.life.78cardsofthetarot-tarotmancy-tarot-cards-and-tarot-readings.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "llew.life.78cardsofthetarot-tarotmancy-tarot-cards-and-tarot-readings.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atMme2-9F9i90quX3hjlMwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 23:33:11
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:225170) triggered by 46.252.245.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 19:33:03.323583 2026] [security2:error] [pid 12301:tid 12301] [client 46.252.245.86:37420] M ...
show more
(mod_security) mod_security (id:225170) triggered by 46.252.245.86 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 19:33:03.323583 2026] [security2:error] [pid 12301:tid 12301] [client 46.252.245.86:37420] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rodzillacharters.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rodzillacharters.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atARL3uf4tocP3An6L2DJAAAAEQ"], referer: https://rodzillacharters.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
