🇫🇷
tecnicorioja
2026-07-29 22:02:18
(9 hours ago)
wp-login attack [29/Jul/2026:04:01:02
Brute-Force
Web App Attack
🇩🇪
ger-stg-sifi1
2026-07-28 20:32:38
(1 day ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
FeG Deutschland
2026-07-28 03:11:04
(2 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-07-28 01:57:27
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 65.108.232.153 (linux898.defaultserverdns.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 65.108.232.153 (linux898.defaultserverdns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 21:57:23.977273 2026] [security2:error] [pid 176890:tid 176890] [client 65.108.232.153:46800] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||michaelmoorefield.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "michaelmoorefield.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amgMg_mqovIeUXxSMPAQngAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-28 01:06:05
(2 days ago)
Trying to access config files
Web App Attack
🇺🇸
TPI-Abuse
2026-07-27 19:00:26
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 65.108.232.153 (linux898.defaultserverdns.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 65.108.232.153 (linux898.defaultserverdns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 15:00:22.252929 2026] [security2:error] [pid 26018:tid 26018] [client 65.108.232.153:47736] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||scrunchiebuttbikinis.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "scrunchiebuttbikinis.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ameqxqjL_7m6_Ng30q6lPQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-07-27 02:59:35
(3 days ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-login-lockdown-high.
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-07-25 04:00:33
(5 days ago)
[SatJul2506:00:30.8209962026][security2:error][pid3971337:tid3971423][client65.108.232.153:0]ModSecu ...
show more
[SatJul2506:00:30.8209962026][security2:error][pid3971337:tid3971423][client65.108.232.153:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"gmint.ch\"][uri\"/xmlrpc.php\"][unique_id\"amQ03sj48JVsXmA-58a_aAAAABc\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-05 08:50:38
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 65.108.232.153 (linux898.defaultserverdns.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 65.108.232.153 (linux898.defaultserverdns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 04:50:33.647994 2026] [security2:error] [pid 18367:tid 18367] [client 65.108.232.153:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||southernbroadcast.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "southernbroadcast.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aiKN2RxooqAyXyfHMR9-dwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇽
octageeks.com
2026-06-05 04:20:13
(1 month ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇺🇸
lostswordfish.com
2026-06-04 21:26:03
(1 month ago)
Wordfence waf block on fypeducation
Web App Attack
🇲🇹
Malta
2026-06-04 16:34:37
(1 month ago)
65.108.232.153 - - [04/Jun/2026:18:34:37 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ubu ...
show more
65.108.232.153 - - [04/Jun/2026:18:34:37 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"
Brute-force password attempt
show less
Hacking
Web App Attack
Brute-Force
🇩🇪
FeG Deutschland
2026-06-02 16:31:12
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇪🇸
masterguru
2025-04-15 13:17:06
(1 year ago)
BAD BOT - Detected and Blocked.. Matched phrase "grequests" at REQUEST_HEADERS:User-Agent. (1100000- ...
show more
BAD BOT - Detected and Blocked.. Matched phrase "grequests" at REQUEST_HEADERS:User-Agent. (1100000-122)
show less
Bad Web Bot
🇫🇷
ingroscart.it
2025-04-14 23:27:21
(1 year ago)
(wordpress) Failed wordpress login from 65.108.232.153 (FI/Finland/linux898.defaultserverdns.com)
Brute-Force