🇫🇷
LRob
2026-11-11 07:37:56
UTC ·
(15 hours ago)
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
xserverx.ru
2026-11-10 21:54:05
UTC ·
(1 day ago)
Honeypot triggered:
IP: 68.50.56.167
Request to: https://xserverx.ru/wp-admin/
Method: GET
Host: xserverx.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Referer: Direct
C ...
show more
Honeypot triggered:
IP: 68.50.56.167
Request to: https://xserverx.ru/wp-admin/
Method: GET
Host: xserverx.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Referer: Direct
Country: Unknown
ASN: Unknown
Triggered rules: (wp-content/|wp-includes/|wp-admin/|/dashboard/), (admin|administrator|root|superuser)
Timestamp: 2026-11-10T21:54:04.850Z
show less
Hacking
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-11-10 19:50:39
UTC ·
(1 day ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-10 19:47:10
UTC ·
(1 day ago)
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0 ...
show more
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Sa
Requested, e.g.:
- proxmox.[REDACTED]/wp-admin/
show less
Web App Attack
🇺🇸
mnsf
2026-11-10 17:05:15
UTC ·
(1 day ago)
Too many Status 40X (14)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 12:55:27
UTC ·
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 68.50.56.167 (c-68-50-56-167.hsd1.in.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 07:55:20.552718 2026] [security2:error] [pid 29538:tid 29538 ...
show more
(mod_security) mod_security (id:225170) triggered by 68.50.56.167 (c-68-50-56-167.hsd1.in.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 07:55:20.552718 2026] [security2:error] [pid 29538:tid 29538] [client 68.50.56.167:35346] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mail.tonispray.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mail.tonispray.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avMUOAL9kI0pMm5vd1rlugAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 09:17:20
UTC ·
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 68.50.56.167 (c-68-50-56-167.hsd1.in.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:17:12.991687 2026] [security2:error] [pid 16852:tid 16852 ...
show more
(mod_security) mod_security (id:225170) triggered by 68.50.56.167 (c-68-50-56-167.hsd1.in.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:17:12.991687 2026] [security2:error] [pid 16852:tid 16852] [client 68.50.56.167:54966] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||customhumanrobots.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "customhumanrobots.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avLhGNyY2SHaJrfyHobeiQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-11-10 06:07:02
UTC ·
(1 day ago)
Try to access /xmlrpc.php
Web App Attack
🇬🇧
ISPLtd
2026-11-08 19:29:02
UTC ·
(3 days ago)
68.50.56.167 - - [08/Nov/2026:15:29:01 -0400] "POST /wp-login.php
68.50.56.167 - - [08/Nov/2026:15:29:01 -0400] "GET /wp-login.php
...
Hacking
Web App Attack
🇩🇪
LRob
2026-11-07 02:23:37
UTC ·
(4 days ago)
Web exploit attempt | method: GET | path: /feed/ | query: author=1 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 | 2026-11-07 02:23 UTC
Hacking
Web App Attack
🇺🇸
dtorrer
2026-11-06 04:11:39
UTC ·
(5 days ago)
Brute-force general attack.
Brute-Force
🇺🇸
lostswordfish.com
2026-11-05 16:02:04
UTC ·
(6 days ago)
Wordfence waf block on registrymatters
Web App Attack
🇨🇿
Countryman
2026-11-05 01:10:01
UTC ·
(6 days ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇮🇩
IndoAbuse
2026-11-04 23:00:49
UTC ·
(1 week ago)
Wordfence 503 block: Repeated malicious requests and bot attacks blocked by WAF.
Brute-Force
Web App Attack
🇪🇸
pipeline.es
2026-11-04 22:22:44
UTC ·
(1 week ago)
WordPress login brute-force | URL: https://gacetadelturismo.com/wp-login.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-04T22:20:47Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\" ...
show more
WordPress login brute-force | URL: https://gacetadelturismo.com/wp-login.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-04T22:20:47Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\"68.50.56.167\",\"status_code\":503,\"url\":\"https://gacetadelturismo.com/wp-login.php\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0\",\"wfid\":4746436} | ASN: COMCAST-7922 | Country: US
show less
Brute-Force
