🇫🇷
Omar Martínez
2026-10-27 22:47:30
(2 minutes ago)
54.225.240.9 - - [27/Oct/2026:16:47:29 -0600] "GET /wp-json/wp/v2/users?per_page=100 HTTP/1.1" 200 1 ...
show more
54.225.240.9 - - [27/Oct/2026:16:47:29 -0600] "GET /wp-json/wp/v2/users?per_page=100 HTTP/1.1" 200 1726 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
...
show less
Phishing
Email Spam
Blog Spam
🇦🇺
2000cn.com.au
2026-10-27 22:38:39
(11 minutes ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-wordpress_user-enum
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-27 22:29:49
(20 minutes ago)
(mod_security) mod_security (id:225170) triggered by 54.225.240.9 (ec2-54-225-240-9.compute-1.amazon ...
show more
(mod_security) mod_security (id:225170) triggered by 54.225.240.9 (ec2-54-225-240-9.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 18:29:45.554482 2026] [security2:error] [pid 11173:tid 11173] [client 54.225.240.9:35982] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||desarrollosdecolima.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "desarrollosdecolima.com"] [uri "/wp-json/wp/v2/users"] [unique_id "auEl2YbkwP_qLfxreP0d4gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
RH5
2026-10-27 22:04:13
(45 minutes ago)
Restricted URL probing (/xmlrpc.php) (UTC 2026-10-27 22:04)
Web App Attack
🇫🇮
YF
2026-10-27 22:01:02
(49 minutes ago)
WordPress author enumeration
Web App Attack
🇺🇸
antlac1
2026-10-27 21:59:12
(50 minutes ago)
crowdsecurity/http-wordpress_user-enum
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-10-27 21:40:04
(1 hour ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇩🇪
neckaralb-admin.de
2026-10-27 21:30:26
(1 hour ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
IndigoRidge
2026-10-27 21:23:17
(1 hour ago)
54.225.240.9 - - [27/Oct/2026:17:23:12 -0400] "GET /wp-json/wp/v2/users?per_page=100&context=edit HT ...
show more
54.225.240.9 - - [27/Oct/2026:17:23:12 -0400] "GET /wp-json/wp/v2/users?per_page=100&context=edit HTTP/1.1" 401 5154 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
54.225.240.9 - - [27/Oct/2026:17:23:12 -0400] "GET /wp-json/wp/v2/users?per_page=100 HTTP/1.1" 200 13680 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
54.225.240.9 - - [27/Oct/2026:17:23:14 -0400] "GET /?author=1 HTTP/1.1" 301 4798 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
54.225.240.9 - - [27/Oct/2026:17:23:15 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
54.225.240.9 - - [27/Oct/2026:17:23:16 -0400] "GET /author/randy_ya4h9opk/ HTTP/1.1" 200 40390 "https://www.buyersinspectiongroup.com/?author=
...
show less
Web App Attack
🇩🇪
ger-stg-sifi1
2026-10-27 21:11:18
(1 hour ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
stinpriza
2026-10-27 21:06:23
(1 hour ago)
Web App Attack
Web App Attack
🇫🇷
masterguru
2026-10-27 20:58:03
(1 hour ago)
xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)
Hacking
2026-10-27 20:55:13
(1 hour ago)
(wordpress-user-enum) Failed wordpress-user-enum trigger from 54.225.240.9 (US/United States/Virgini ...
show more
(wordpress-user-enum) Failed wordpress-user-enum trigger from 54.225.240.9 (US/United States/Virginia/Ashburn/ec2-54-225-240-9.compute-1.amazonaws.com/[redacted]): (CF_ENABLE)
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-10-27 20:54:53
(1 hour ago)
(mod_security) mod_security (id:225170) triggered by 54.225.240.9 (ec2-54-225-240-9.compute-1.amazon ...
show more
(mod_security) mod_security (id:225170) triggered by 54.225.240.9 (ec2-54-225-240-9.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 16:54:47.139126 2026] [security2:error] [pid 1214:tid 1214] [client 54.225.240.9:38294] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||adona.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "adona.org"] [uri "/wp-json/wp/v2/users"] [unique_id "auEPl2soCwWem2GoVNu-YQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
Jova
2026-10-27 20:38:08
(2 hours ago)
WordPress user enumeration: 5 requests.
Web App Attack
