🇲🇽
octageeks.com
2026-10-27 04:30:26
(1 day ago)
Wordpress malicious attack:[octawpauthor]
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 04:22:23
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 49.194.112.62 (n49-194-112-62.per2.wa.optusnet. ...
show more
(mod_security) mod_security (id:225170) triggered by 49.194.112.62 (n49-194-112-62.per2.wa.optusnet.com.au): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 00:22:16.579237 2026] [security2:error] [pid 5225:tid 5225] [client 49.194.112.62:47406] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||market1st.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "market1st.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "auAm-Af3o84ezX8q4UjXFgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 20:08:21
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 49.194.112.62 (n49-194-112-62.per2.wa.optusnet. ...
show more
(mod_security) mod_security (id:225170) triggered by 49.194.112.62 (n49-194-112-62.per2.wa.optusnet.com.au): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 16:08:13.634227 2026] [security2:error] [pid 18536:tid 18536] [client 49.194.112.62:51366] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||magacine.tv|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "magacine.tv"] [uri "/wp-json/wp/v2/users"] [unique_id "at-zLTLcmkrXNawVrjpUEgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
JRID
2026-10-25 23:02:47
(2 days ago)
Detected by CrowdSec + Suricata IDS: automated attack/scan against web servers.
Brute-Force
Web App Attack
🇩🇪
big-cloud.nl
2026-10-25 19:09:38
(2 days ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
dtorrer
2026-10-25 18:43:37
(2 days ago)
Brute-force general attack.
Brute-Force
🇺🇸
cwytech
2026-10-24 02:38:34
(4 days ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-login-lockdown-high.
Bad Web Bot
Web App Attack
2026-10-23 23:44:57
(4 days ago)
49.194.112.62 - - [24/Oct/2026:01:44:51 +0200] "POST /wp-login.php HTTP/2.0" 200 4417 "https://dot.a ...
show more
49.194.112.62 - - [24/Oct/2026:01:44:51 +0200] "POST /wp-login.php HTTP/2.0" 200 4417 "https://dot.alliance.fm/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇵🇱
lns.bz
2026-10-22 10:21:36
(5 days ago)
Web app attack [PL.Lu]
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 04:38:44
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 49.194.112.62 (n49-194-112-62.per2.wa.optusnet. ...
show more
(mod_security) mod_security (id:225170) triggered by 49.194.112.62 (n49-194-112-62.per2.wa.optusnet.com.au): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 00:38:35.373340 2026] [security2:error] [pid 27837:tid 27864] [client 49.194.112.62:45724] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cynosureinternetservices.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cynosureinternetservices.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atmTS8S4qHVDCyLg7OLWqgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-10-20 09:17:55
(1 week ago)
Try to access /xmlrpc.php
Web App Attack
🇫🇷
LRob
2026-10-19 13:03:11
(1 week ago)
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 ...
show more
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
show less
Bad Web Bot
🇦🇺
foff
2026-10-18 14:05:14
(1 week ago)
Source IP: 49.194.112.62 (AU/Microplex PTY LTD). SQL injection attempt detected by OWASP CRS. Attack ...
show more
Source IP: 49.194.112.62 (AU/Microplex PTY LTD). SQL injection attempt detected by OWASP CRS. Attack observed 2026-10-19T01:05:14+11:00.
show less
SQL Injection
🇩🇪
FeG Deutschland
2026-10-18 02:56:27
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 02:13:54
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 49.194.112.62 (n49-194-112-62.per2.wa.optusnet. ...
show more
(mod_security) mod_security (id:225170) triggered by 49.194.112.62 (n49-194-112-62.per2.wa.optusnet.com.au): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 22:13:48.416795 2026] [security2:error] [pid 27298:tid 27298] [client 49.194.112.62:41538] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||clayrivers.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "clayrivers.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atLZ3JoglsrDr-xqwYH-9wAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
