🇺🇸
TPI-Abuse
2026-06-12 12:55:16
(12 minutes ago)
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your- ...
show more
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 08:55:08.215805 2026] [security2:error] [pid 22506:tid 22506] [client 65.21.94.176:41944] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||tarekshohaieb.online|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tarekshohaieb.online"] [uri "/wp-json/wp/v2/users"] [unique_id "aiwBrJNFszEp6e2Ua4TIxwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 12:27:38
(39 minutes ago)
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your- ...
show more
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 08:27:30.827169 2026] [security2:error] [pid 26856:tid 26856] [client 65.21.94.176:43248] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||brbcash.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "brbcash.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiv7Moi008LzoqiY3mfZdQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 05:34:39
(7 hours ago)
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your- ...
show more
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 01:34:35.627637 2026] [security2:error] [pid 22876:tid 22876] [client 65.21.94.176:33536] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||twogocamping.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "twogocamping.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiuaa9AWkVFvuEob5DSCIAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-12 01:51:32
(11 hours ago)
[redacted] 65.21.94.176 - - [12/Jun/2026:03:51:28 +0200] "POST /xmlrpc.php HTTP/1.1" 200 261 "-" "Mo ...
show more
[redacted] 65.21.94.176 - - [12/Jun/2026:03:51:28 +0200] "POST /xmlrpc.php HTTP/1.1" 200 261 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0"
[redacted] 65.21.94.176 - - [12/Jun/2026:03:51:27 +0200] "POST /xmlrpc.php HTTP/1.1" 200 261 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:43.0) Gecko/20100101 Firefox/43.0"
[redacted] 65.21.94.176 - - [12/Jun/2026:03:51:27 +0200] "POST /xmlrpc.php HTTP/1.1" 200 261 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0"
[redacted] 65.21.94.176 - - [12/Jun/2026:03:51:28 +0200] "POST /xmlrpc.php HTTP/1.1" 200 261 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0"
[redacted] 65.21.94.176 - - [12/Jun/2026:03:51:29 +0200] "POST /xmlrpc.php HTTP/1.1" 200 261 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0"
[redacted] 65.21.94.176 - - [12/Jun/2026:03:51:29 +0200] "POST /xmlrpc.php HTTP/1.1" 200 261 "-" "M
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 22:02:43
(15 hours ago)
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your- ...
show more
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 18:02:39.795967 2026] [security2:error] [pid 9781:tid 9781] [client 65.21.94.176:40934] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.blublk.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.blublk.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiswfxfgxZB7gN3GrdOTmAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-06-11 14:35:20
(22 hours ago)
(wp_login_try) srv104 WP Login Attempt 65.21.94.176 (FI/Finland/static.176.94.21.65.clients.your-ser ...
show more
(wp_login_try) srv104 WP Login Attempt 65.21.94.176 (FI/Finland/static.176.94.21.65.clients.your-server.de): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 01:21:55
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your- ...
show more
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 21:21:50.534315 2026] [security2:error] [pid 27304:tid 27304] [client 65.21.94.176:58140] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.allotrope.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.allotrope.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aioNrqhhPnlvm9N5SDpcWwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 23:24:08
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your- ...
show more
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 19:24:05.426371 2026] [security2:error] [pid 12923:tid 12923] [client 65.21.94.176:32904] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.nextstepplus.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.nextstepplus.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ainyFY86AKKGpHQZl-pMCgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-06-10 19:47:01
(1 day ago)
trying wp-login.php/xmlrpc.php 124 times in 1 minutes
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-06-10 16:44:47
(1 day ago)
WordPress wp-login.php Brute Force Attack
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-06-10 12:31:35
(2 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 08:59:18
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your- ...
show more
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 04:59:10.840874 2026] [security2:error] [pid 7382:tid 7382] [client 65.21.94.176:56778] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rotentendales.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rotentendales.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiknXvZUhb4inSVIKBfQjgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 04:42:58
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your- ...
show more
(mod_security) mod_security (id:225170) triggered by 65.21.94.176 (static.176.94.21.65.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 00:42:54.828463 2026] [security2:error] [pid 6741:tid 6761] [client 65.21.94.176:44858] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.leaderoftheopposition.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.leaderoftheopposition.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aijrTtz-I3pGz_XmcucHJQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-10 01:26:24
(2 days ago)
(wordpress) Failed wordpress login from 65.21.94.176 (FI/Finland/static.176.94.21.65.clients.your-se ...
show more
(wordpress) Failed wordpress login from 65.21.94.176 (FI/Finland/static.176.94.21.65.clients.your-server.de)
show less
Brute-Force
2026-06-10 00:37:58
(2 days ago)
[redacted] 65.21.94.176 - - [10/Jun/2026:02:37:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mo ...
show more
[redacted] 65.21.94.176 - - [10/Jun/2026:02:37:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0"
[redacted] 65.21.94.176 - - [10/Jun/2026:02:37:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0"
[redacted] 65.21.94.176 - - [10/Jun/2026:02:37:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0"
[redacted] 65.21.94.176 - - [10/Jun/2026:02:37:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0"
[redacted] 65.21.94.176 - - [10/Jun/2026:02:37:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 216 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0"
[redacted] 65.21.94.176 - - [10/Jun/2
...
show less
Hacking
Web App Attack