🇩🇪
FeG Deutschland
2026-11-10 23:54:01
UTC ·
(1 day ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 15:04:25
UTC ·
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 72.255.7.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:04:15.957508 2026] [security2:error] [pid 6565:tid 6565] [client 72.255.7.123:12100] ModSe ...
show more
(mod_security) mod_security (id:225170) triggered by 72.255.7.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:04:15.957508 2026] [security2:error] [pid 6565:tid 6565] [client 72.255.7.123:12100] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||reelvisionboard.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "reelvisionboard.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avMybxuhQws2v4yZzdDzMQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
ICS Labs
2026-11-09 20:09:34
UTC ·
(2 days ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-09 UTC.
Brute-Force
🇩🇪
ghostwarriors
2026-11-09 14:20:15
UTC ·
(2 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-09 13:55:55
UTC ·
(2 days ago)
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome ...
show more
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.
Requested, e.g.:
- nextcloud.[REDACTED]/wp-login.php
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 10:04:50
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 72.255.7.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 05:04:44.998806 2026] [security2:error] [pid 25510:tid 25510] [client 72.255.7.123:11119] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 72.255.7.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 05:04:44.998806 2026] [security2:error] [pid 25510:tid 25510] [client 72.255.7.123:11119] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||savingspools.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "savingspools.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avGavAU1W_MonFMbOFFszQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 09:06:21
UTC ·
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 72.255.7.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 04:06:11.378170 2026] [security2:error] [pid 2240:tid 2240] [client 72.255.7.123:10481] ModSe ...
show more
(mod_security) mod_security (id:225170) triggered by 72.255.7.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 04:06:11.378170 2026] [security2:error] [pid 2240:tid 2240] [client 72.255.7.123:10481] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||prcomputersolutions.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "prcomputersolutions.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "au2Yg7iBVsCCzKnBM40RywAAADY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-11-04 01:10:06
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇩🇪
inlink.ltd
2026-11-03 15:02:35
UTC ·
(1 week ago)
Known malicious PHP file or CMS probe
Web App Attack
🇲🇹
Malta
2026-11-03 04:40:35
UTC ·
(1 week ago)
72.255.7.123 - - [03/Nov/2026:05:40:35 +0100] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Mobile Safari/537.36"
Brute-force password attempt
Hacking
Web App Attack
Brute-Force
🇺🇸
TPI-Abuse
2026-10-31 15:50:53
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 72.255.7.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 11:50:43.800091 2026] [security2:error] [pid 7468:tid 7562] [client 72.255.7.123:11559] ModSe ...
show more
(mod_security) mod_security (id:225170) triggered by 72.255.7.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 11:50:43.800091 2026] [security2:error] [pid 7468:tid 7562] [client 72.255.7.123:11559] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bortec-corp.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bortec-corp.com"] [uri "/wp-json/wp/v2/users"] [unique_id "auYOUxBuWRq8pGMCWrz7AAAAAQg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-10-31 01:10:01
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇳🇱
MM-bot
2026-10-29 09:47:08
UTC ·
(1 week ago)
URL-probe: HTTP/2 GET request on /wp-admin/ (2026-10-29 10:47:08 UTC+1)
Web App Attack
Hacking
🇺🇸
HJ5Ss4Ju
2026-10-27 17:17:35
UTC ·
(2 weeks ago)
Wordfence firewall block
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 14:00:20
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 72.255.7.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 09:59:59.533151 2026] [security2:error] [pid 30744:tid 30744] [client 72.255.7.123:0] ModSecu ...
show more
(mod_security) mod_security (id:225170) triggered by 72.255.7.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 09:59:59.533151 2026] [security2:error] [pid 30744:tid 30744] [client 72.255.7.123:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ac.cloudex.click|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ac.cloudex.click"] [uri "/wp-json/wp/v2/users/me"] [unique_id "auCuX2wwju1da-TxLGXDCgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
