🇪🇸
Gem
2026-07-03 22:17:48
(9 hours ago)
Unauthorized web scan.
Web App Attack
🇦🇹
neo72
2026-07-03 08:14:32
(23 hours ago)
Detected malicious activity - bulk block
Brute-Force
Web App Attack
🇺🇸
TAY
2026-07-03 00:07:01
(1 day ago)
52.176.124.177 - - [03/Jul/2026:08:06:54 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6586 "-" "Mozilla/5. ...
show more
52.176.124.177 - - [03/Jul/2026:08:06:54 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6586 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
52.176.124.177 - - [03/Jul/2026:08:06:54 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6136 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0"
52.176.124.177 - - [03/Jul/2026:08:06:54 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6136 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/109.0.0.0"
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-07-03 00:03:51
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 52.176.124.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 52.176.124.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 20:03:46.150487 2026] [security2:error] [pid 28770:tid 28770] [client 52.176.124.177:40391] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thehandyfamily.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thehandyfamily.net"] [uri "/wp-json/wp/v2/users/"] [unique_id "akb8Yl_yEze4UlLoDUsluwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Mundo Bueno
2026-07-03 00:00:21
(1 day ago)
[ISILIA Protection v2.1] Tentative d'accès: /wp-json/wp/v2/users/ | Pays: US | UA: Mozilla/5.0 (Wind ...
show more
[ISILIA Protection v2.1] Tentative d'accès: /wp-json/wp/v2/users/ | Pays: US | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Sa
show less
Hacking
Web App Attack
🇺🇸
ArturShelby
2026-07-02 23:56:19
(1 day ago)
Honeypot triggered: /wp-json/wp/v2/users/
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 23:47:02
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 52.176.124.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 52.176.124.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 19:46:55.180285 2026] [security2:error] [pid 20797:tid 20797] [client 52.176.124.177:40495] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||forefrontmusic.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "forefrontmusic.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akb4b_rCf4wMrltmYd9fYQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 22:53:03
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 52.176.124.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 52.176.124.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 18:52:57.220298 2026] [security2:error] [pid 18928:tid 18928] [client 52.176.124.177:40851] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lspfest.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lspfest.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbryaUn-kj4vcbbmz51awAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
beon
2026-07-02 22:49:42
(1 day ago)
[DateTime=>2026-07-02T22:49:42Z (UTC)] , [HoneyPot_Hit=>once] , [HoneyPot=>/wp-json/wp/v2/users/] , ...
show more
[DateTime=>2026-07-02T22:49:42Z (UTC)] , [HoneyPot_Hit=>once] , [HoneyPot=>/wp-json/wp/v2/users/] , [total_Hit=>once] , [Keyword=>WordPress]
show less
Bad Web Bot
Web App Attack
🇧🇬
HighWay
2026-07-02 22:45:05
(1 day ago)
52.176.124.177 - - [02/Jul/2026:22:45:01 +0000] "POST /xmlrpc.php HTTP/1.1" 200 5113 "-" "Mozilla/5. ...
show more
52.176.124.177 - - [02/Jul/2026:22:45:01 +0000] "POST /xmlrpc.php HTTP/1.1" 200 5113 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"
52.176.124.177 - - [02/Jul/2026:22:45:02 +0000] "POST /xmlrpc.php HTTP/1.1" 200 4662 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15"
52.176.124.177 - - [02/Jul/2026:22:45:02 +0000] "POST /xmlrpc.php HTTP/1.1" 200 4664 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:125.0) Gecko/20100101 Firefox/125.0"
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-07-02 22:20:27
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 52.176.124.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 52.176.124.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 18:20:22.797271 2026] [security2:error] [pid 997:tid 997] [client 52.176.124.177:39003] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||heytechiesshow.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "heytechiesshow.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbkJiblVwA82vyWebArRQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 21:58:55
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 52.176.124.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 52.176.124.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 17:58:47.728957 2026] [security2:error] [pid 27966:tid 27966] [client 52.176.124.177:39483] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||austinbiblestudents.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "austinbiblestudents.org"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbfF-sBAOlz_db8Mi3WvAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-07-02 21:49:10
(1 day ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
2026-07-02 21:35:37
(1 day ago)
Fail2ban filtered
...
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 21:29:48
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 52.176.124.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 52.176.124.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 17:29:44.900067 2026] [security2:error] [pid 4322:tid 4322] [client 52.176.124.177:40288] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||coolerboxes.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "coolerboxes.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbYSEZNHkFA-sm-vp0wvQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack