🇺🇸
ANTI SCANNER
2026-06-13 16:24:28
(2 days ago)
Scanner : /xmlrpc.php
Web Spam
🇺🇸
kosada.com
2026-06-07 17:42:56
(1 week ago)
Web password guessing
Brute-Force
🇺🇸
TPI-Abuse
2026-06-04 19:35:56
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 15:35:42.856679 2026] [security2:error] [pid 29391:tid 29391] [client 62.3.0.106:41865] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||catzpaw.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "catzpaw.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiHTjv_s4ExB0zXbAX27WwAAAAI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-31 20:37:44
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 16:37:31.394368 2026] [security2:error] [pid 8089:tid 8101] [client 62.3.0.106:23751] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||wbwstudio.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "wbwstudio.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahycCw4rH5W776E2S1abawAAAQo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-05-22 13:55:10
(3 weeks ago)
Web password guessing
Brute-Force
🇺🇸
TPI-Abuse
2026-05-18 04:38:50
(4 weeks ago)
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 00:38:33.573066 2026] [security2:error] [pid 15600:tid 15600] [client 62.3.0.106:18619] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||unitedstarsaerospace.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "unitedstarsaerospace.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agqXyX4hYsKStzRGfs5uzgAAABE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob.fr
2026-05-11 13:45:06
(1 month ago)
WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-04-30 19:42:17
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 15:42:04.502669 2026] [security2:error] [pid 18425:tid 18425] [client 62.3.0.106:18181] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||macryder.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "macryder.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afOwjOn8MlBswUtDJSCSeAAAAAY"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-04-25 13:00:22
(1 month ago)
Web password guessing
Brute-Force
🇺🇸
TPI-Abuse
2026-04-06 12:36:01
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 08:35:53.270933 2026] [security2:error] [pid 41124:tid 41124] [client 62.3.0.106:16339] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||delucchi.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "delucchi.net"] [uri "/wp-json/wp/v2/users"] [unique_id "adOoqYfjY5f74bqsgph7TgAAABo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 02:16:29
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 22:16:13.287607 2026] [security2:error] [pid 675:tid 675] [client 62.3.0.106:28731] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||franzexpress.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "franzexpress.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acnc7Z1iKYPmBrN9zhuh9wAAAAk"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-28 18:07:21
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 62.3.0.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 28 14:07:06.906527 2026] [security2:error] [pid 23380:tid 23420] [client 62.3.0.106:53669] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||digital4z.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "digital4z.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acgYyjEb_UyXjqPAJiKQewAAAEE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ambor
2026-03-28 12:34:06
(2 months ago)
Honeypot access: WordPress admin access attempt. Path: /wp-login.php
Brute-Force
Web App Attack
🇨🇭
backslash
2026-03-03 09:12:01
(3 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
2026-03-03 08:15:11
(3 months ago)
[redacted] 62.3.0.106 - - [03/Mar/2026:09:15:02 +0100] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apac ...
show more
[redacted] 62.3.0.106 - - [03/Mar/2026:09:15:02 +0100] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
[redacted] 62.3.0.106 - - [03/Mar/2026:09:15:03 +0100] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
[redacted] 62.3.0.106 - - [03/Mar/2026:09:15:05 +0100] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
[redacted] 62.3.0.106 - - [03/Mar/2026:09:15:07 +0100] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
[redacted] 62.3.0.106 - - [03/Mar/2026:09:15:11 +0100] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)"
...
show less
Hacking
Web App Attack