🇺🇸
nationaleventpros.com
2026-06-14 18:55:47
(2 months ago)
WordPress login attempt
Brute-Force
🇺🇸
TPI-Abuse
2026-06-12 14:11:06
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 10:10:50.018700 2026] [security2:error] [pid 5489:tid 5489] [client 5.181.170.178:21483] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||coopstehedwidge.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "coopstehedwidge.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiwTajuyhZtUlfAY44ppMwAAAAw"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-06-11 21:12:50
(2 months ago)
[ThuJun1123:12:35.4833872026][security2:error][pid2628932:tid2629031][client5.181.170.178:0]ModSecur ...
show more
[ThuJun1123:12:35.4833872026][security2:error][pid2628932:tid2629031][client5.181.170.178:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"studio-portale.ch\"][uri\"/xmlrpc.php\"][unique_id\"aiskw574Qxk1mIv3aI9YSAAAAME\"]
show less
Port Scan
Brute-Force
Web App Attack
2026-06-11 17:17:50
(2 months ago)
PARMACOM WEBEXPLOIT 5.181.170.178 (5.181.170.178)
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 13:29:07
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 09:28:52.370656 2026] [security2:error] [pid 15183:tid 15203] [client 5.181.170.178:10239] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bbpuertadelsol.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bbpuertadelsol.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ah7alCVi21dXmGJcWyxkyQAAAFE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-22 01:49:03
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 21:48:48.734120 2026] [security2:error] [pid 19149:tid 19149] [client 5.181.170.178:34255] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||acpparalegal.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "acpparalegal.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag-2ACcKoD0h4o_LOV68BQAAABQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
pamircil
2026-05-14 19:03:36
(3 months ago)
🍯 WinnieThePooh Honeypot : GET request to '/wp-content/themes/twentyseventeen' on (http/80)💀
SSH
Brute-Force
Hacking
🇺🇸
TPI-Abuse
2026-04-12 02:47:24
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 22:47:09.044427 2026] [security2:error] [pid 1933210:tid 1933233] [client 5.181.170.178:42035] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||pizzadlux.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "pizzadlux.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adsHrarK5paKxDYOixMPywAAABQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-11 10:13:44
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 06:13:31.190728 2026] [security2:error] [pid 4072458:tid 4072458] [client 5.181.170.178:34701] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thenewplace.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thenewplace.org"] [uri "/wp-json/wp/v2/users"] [unique_id "adoey5hsXs_hXpeF4P6JTwAAAAU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
ptlab
2026-04-10 18:45:30
(4 months ago)
Detected wp_login attack from WP-host.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-04-10 17:32:52
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 10 13:32:30.165504 2026] [security2:error] [pid 2385135:tid 2385135] [client 5.181.170.178:64233] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.csm-dtc.com"] [uri "/wp-config.php.1"] [unique_id "adk0Lna_-g_Vdcbkw-vgWwAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 06:27:32
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 02:27:17.084619 2026] [security2:error] [pid 3289705:tid 3289705] [client 5.181.170.178:25553] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thecalls.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thecalls.net"] [uri "/wp-json/wp/v2/users"] [unique_id "adX1RcJAR9mZadJug2PyBQAAAAY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-04-05 13:18:00
(5 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2026-03-25 20:55:52
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 5.181.170.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 16:55:36.046032 2026] [security2:error] [pid 1191:tid 1191] [client 5.181.170.178:32551] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||oceandrivebeach.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "oceandrivebeach.net"] [uri "/wp-json/wp/v2/users"] [unique_id "acRLyOTBqs6e-dFv0C6yNgAAABg"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xmission.com
2026-03-02 14:26:14
(6 months ago)
5.181.170.178 - - [02/Mar/2026:07:26:13 -0700] "POST /wp-login.php HTTP/1.1" 200 2355 "https://dooce ...
show more
5.181.170.178 - - [02/Mar/2026:07:26:13 -0700] "POST /wp-login.php HTTP/1.1" 200 2355 "https://dooce.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
...
show less
Brute-Force