🇩🇪
reznekcs
2026-06-21 20:33:39
(3 hours ago)
F2B wordpress ban. Logs: 52.4.171.64 - - [21/Jun/2026:22:33:37 +0200] "POST /xmlrpc.php HTTP/1.1" 20 ...
show more
F2B wordpress ban. Logs: 52.4.171.64 - - [21/Jun/2026:22:33:37 +0200] "POST /xmlrpc.php HTTP/1.1" 200 420 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0"
52.4.171.64 - - [21/Jun/2026:22:33:38 +0200] "POST /xmlrpc.php HTTP/1.1" 200 458 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0"
show less
Brute-Force
Web App Attack
🇳🇱
Mangelot Hosting
2026-06-21 15:18:25
(8 hours ago)
(wp_login_try) srv101 WP Login Attempt 52.4.171.64 (US/United States/ec2-52-4-171-64.compute-1.amazo ...
show more
(wp_login_try) srv101 WP Login Attempt 52.4.171.64 (US/United States/ec2-52-4-171-64.compute-1.amazonaws.com): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇮🇹
VHosting
2026-06-21 13:45:04
(10 hours ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-20 23:22:37
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaw ...
show more
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 19:22:34.062187 2026] [security2:error] [pid 21809:tid 21809] [client 52.4.171.64:43390] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.mundanestudies.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.mundanestudies.org"] [uri "/wp-json/wp/v2/users"] [unique_id "ajcgukk0PFMn5SKatX3w6gAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-20 22:21:31
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaw ...
show more
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 18:21:25.411448 2026] [security2:error] [pid 26045:tid 26045] [client 52.4.171.64:57292] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||marinestorage.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "marinestorage.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajcSZd1VsG1tMOmHz5bRcAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-20 17:26:05
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaw ...
show more
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 13:25:59.715413 2026] [security2:error] [pid 1937:tid 1937] [client 52.4.171.64:57440] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.soonerstone.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.soonerstone.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajbNJzdzG_9fD3OQnWhTHQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
factor1
2026-06-20 16:50:11
(1 day ago)
Fail2ban at saturn Reports Abuse.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-20 04:54:54
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaw ...
show more
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 00:54:49.556966 2026] [security2:error] [pid 17345:tid 17345] [client 52.4.171.64:48186] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.orcastrong.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.orcastrong.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajYdGSwWwWwf7OKyFMCT3QAAACg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-20 00:52:59
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaw ...
show more
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 20:52:53.355319 2026] [security2:error] [pid 9833:tid 9833] [client 52.4.171.64:54746] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.lumentravel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.lumentravel.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajXkZd2F1i2KeducXIs4QQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-19 23:30:55
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaw ...
show more
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 19:30:51.531654 2026] [security2:error] [pid 3995:tid 3995] [client 52.4.171.64:53242] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||learnserve.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "learnserve.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ajXRK2GNxVy8Ucu_AwUa7wAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-19 19:59:09
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaw ...
show more
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 15:59:06.718340 2026] [security2:error] [pid 29337:tid 29337] [client 52.4.171.64:38076] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||vintageamptubes.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "vintageamptubes.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajWfit5OYnUgxSs2vrflSgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-19 18:30:31
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaw ...
show more
(mod_security) mod_security (id:225170) triggered by 52.4.171.64 (ec2-52-4-171-64.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 14:30:27.444239 2026] [security2:error] [pid 16905:tid 16921] [client 52.4.171.64:44220] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.smarterproductions.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.smarterproductions.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajWKw6oHcU0RsZxdZnN4ZgAAAMw"]
show less
Brute-Force
Bad Web Bot
Web App Attack