🇺🇸
TPI-Abuse
2026-11-14 17:41:41
UTC ·
(35 minutes ago)
(mod_security) mod_security (id:225170) triggered by 70.30.221.183 (bras-base-qubcpq1550w-grc-09-70-30-221-183.dsl.bell.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 12:41:35.891600 2026] [security2:error] ...
show more
(mod_security) mod_security (id:225170) triggered by 70.30.221.183 (bras-base-qubcpq1550w-grc-09-70-30-221-183.dsl.bell.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 12:41:35.891600 2026] [security2:error] [pid 28532:tid 28670] [client 70.30.221.183:47274] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||boxvalleyrockers.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "boxvalleyrockers.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avidTx4qjwtMoF72T1Pk4QAAAkg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
neckaralb-admin.de
2026-11-14 09:34:05
UTC ·
(8 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
ghostwarriors
2026-11-12 19:23:34
UTC ·
(1 day ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 15:18:37
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 70.30.221.183 (bras-base-qubcpq1550w-grc-09-70-30-221-183.dsl.bell.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 10:18:30.088316 2026] [security2:error] ...
show more
(mod_security) mod_security (id:225170) triggered by 70.30.221.183 (bras-base-qubcpq1550w-grc-09-70-30-221-183.dsl.bell.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 10:18:30.088316 2026] [security2:error] [pid 29751:tid 29751] [client 70.30.221.183:56248] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ewingmissouri.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ewingmissouri.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avXYxglhxcPRMG_J8KwluAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 01:57:02
UTC ·
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 70.30.221.183 (bras-base-qubcpq1550w-grc-09-70-30-221-183.dsl.bell.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:56:55.515238 2026] [security2:error] ...
show more
(mod_security) mod_security (id:225170) triggered by 70.30.221.183 (bras-base-qubcpq1550w-grc-09-70-30-221-183.dsl.bell.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:56:55.515238 2026] [security2:error] [pid 30478:tid 30490] [client 70.30.221.183:53602] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hmpdecors.com.oplconnect.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hmpdecors.com.oplconnect.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avPLZ4txRZtlqRElTrWZnQAAAQk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-11-10 19:51:52
UTC ·
(3 days ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 12:06:59
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 70.30.221.183 (bras-base-qubcpq1550w-grc-09-70-30-221-183.dsl.bell.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 07:06:54.950628 2026] [security2:error] ...
show more
(mod_security) mod_security (id:225170) triggered by 70.30.221.183 (bras-base-qubcpq1550w-grc-09-70-30-221-183.dsl.bell.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 07:06:54.950628 2026] [security2:error] [pid 13459:tid 13459] [client 70.30.221.183:52646] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||smogsandiego.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "smogsandiego.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avMI3gUUvz2KcHjaslqOqgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
ICS Labs
2026-11-09 20:08:24
UTC ·
(4 days ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-09 UTC.
Brute-Force
🇩🇪
ghostwarriors
2026-11-09 09:50:49
UTC ·
(5 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-09 09:46:14
UTC ·
(5 days ago)
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0 ...
show more
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Sa
Requested, e.g.:
- gitea.[REDACTED]/wp-login.php
show less
Web App Attack
🇩🇪
LRob
2026-11-06 12:12:14
UTC ·
(1 week ago)
Web exploit attempt | method: GET | path: / | query: author=4&feed=rss2 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 | 2026-11-06 12:12 UTC
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 07:17:39
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 70.30.221.183 (bras-base-qubcpq1550w-grc-09-70-30-221-183.dsl.bell.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 02:17:33.557827 2026] [security2:error] ...
show more
(mod_security) mod_security (id:225170) triggered by 70.30.221.183 (bras-base-qubcpq1550w-grc-09-70-30-221-183.dsl.bell.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 02:17:33.557827 2026] [security2:error] [pid 16654:tid 16654] [client 70.30.221.183:34178] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||midway-island.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "midway-island.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au1_Dc8jQ8TA4RbArUE-qwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
lp
2026-11-05 03:48:27
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 70.30.221.183
2026-11-05T04:31:10+0100 vpn Access-Reject station: 70.30.221.183
Brute-Force
Web App Attack
🇫🇷
ingroscart.it
2026-11-05 01:23:11
UTC ·
(1 week ago)
(wordpress) Failed wordpress login from 70.30.221.183 (CA/Canada/Quebec/Longueuil/bras-base-qubcpq1550w-grc-09-70-30-221-183.dsl.bell.ca/[redacted])
Brute-Force
🇨🇿
Countryman
2026-11-05 01:10:01
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
