🇫🇷
SpaceHost-Server
2026-06-12 22:30:08
(5 hours ago)
Brute-Force
Web App Attack
🇷🇺
DZBOT
2026-06-12 18:20:54
(10 hours ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 18:17:02
(10 hours ago)
(mod_security) mod_security (id:225170) triggered by 52.188.87.1 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 52.188.87.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 14:16:54.240826 2026] [security2:error] [pid 11044:tid 11044] [client 52.188.87.1:8182] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||drgtek.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "drgtek.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aixNFvH_wSpKFaiBbhkNyQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-12 18:15:56
(10 hours ago)
Web attack blocked by Wordfence on www.gerhuntjens.nl (2 hits). Reported by CRMON.
Web App Attack
2026-06-12 18:02:21
(10 hours ago)
[redacted] 52.188.87.1 - - [12/Jun/2026:20:02:03 +0200] "POST /xmlrpc.php HTTP/2.0" 200 216 "-" "Moz ...
show more
[redacted] 52.188.87.1 - - [12/Jun/2026:20:02:03 +0200] "POST /xmlrpc.php HTTP/2.0" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.37"
[redacted] 52.188.87.1 - - [12/Jun/2026:20:02:06 +0200] "POST /xmlrpc.php HTTP/2.0" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
[redacted] 52.188.87.1 - - [12/Jun/2026:20:02:08 +0200] "POST /xmlrpc.php HTTP/2.0" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
[redacted] 52.188.87.1 - - [12/Jun/2026:20:02:09 +0200] "POST /xmlrpc.php HTTP/2.0" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
[redacted] 52.188.87.1 - - [12/Jun/2026:20:02:11 +0200] "POST /xmlrpc.php HTTP/2.0" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 17:54:56
(10 hours ago)
(mod_security) mod_security (id:225170) triggered by 52.188.87.1 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 52.188.87.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 13:54:53.085169 2026] [security2:error] [pid 16254:tid 16254] [client 52.188.87.1:6812] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.batesstrategygroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.batesstrategygroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aixH7WbNRra41IztluIHawAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
BlueWire Hosting
2026-06-12 17:45:12
(10 hours ago)
Probing websites for vulnerabilities
Web App Attack
🇺🇸
bigwavedave
2026-06-12 17:41:01
(10 hours ago)
Wordpress Attack
Web App Attack
🇩🇪
grassau.com
2026-06-12 17:37:23
(10 hours ago)
(wordpress) Failed wordpress login from 52.188.87.1 (US/United States/Virginia/Arlington/-)
Brute-Force
🇪🇸
masterguru
2026-06-12 17:37:18
(10 hours ago)
(xmlrpc) Failed xmlrpc access from 52.188.87.1 (US/United States/-): 5 in the last 3600 secs (0-122)
Hacking
2026-06-12 17:36:04
(10 hours ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/2.0
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 17:19:25
(11 hours ago)
(mod_security) mod_security (id:225170) triggered by 52.188.87.1 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 52.188.87.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 13:19:17.873294 2026] [security2:error] [pid 11646:tid 11646] [client 52.188.87.1:7135] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.healthmarkcounseling.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.healthmarkcounseling.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aiw_lZZ_0uwn-DymVmoOSwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob.fr
2026-06-12 17:15:08
(11 hours ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-06-12 17:05:29
(11 hours ago)
Xmlrpc Caught (12)
Too many Status 40X (12)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 17:03:04
(11 hours ago)
(mod_security) mod_security (id:225170) triggered by 52.188.87.1 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 52.188.87.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 13:02:56.043749 2026] [security2:error] [pid 24002:tid 24002] [client 52.188.87.1:6739] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||dwightbrown.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dwightbrown.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aiw7wP0D68cI9o0YHTpEKwAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack