🇩🇪
big-cloud.nl
2026-11-12 07:57:20
UTC ·
(47 minutes ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 18:07:16
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 72.27.53.217 (217-53-27-72-br1-DYNAMIC-dsl.cwjamaica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 14:07:11.417656 2026] [security2:error] [pid 10122:t ...
show more
(mod_security) mod_security (id:225170) triggered by 72.27.53.217 (217-53-27-72-br1-DYNAMIC-dsl.cwjamaica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 14:07:11.417656 2026] [security2:error] [pid 10122:tid 10122] [client 72.27.53.217:58579] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||justicehoward.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "justicehoward.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "auOLTyM_gg6HfNXFL1NYpgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 04:47:33
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 72.27.53.217 (217-53-27-72-br1-DYNAMIC-dsl.cwjamaica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 00:47:28.090607 2026] [security2:error] [pid 29368:t ...
show more
(mod_security) mod_security (id:225170) triggered by 72.27.53.217 (217-53-27-72-br1-DYNAMIC-dsl.cwjamaica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 00:47:28.090607 2026] [security2:error] [pid 29368:tid 29368] [client 72.27.53.217:16718] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||constructionloansfunding.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "constructionloansfunding.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atw4YILWramv-hqOoJ4CcQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Hazzard
2026-10-23 11:07:56
UTC ·
(2 weeks ago)
(wordpress) Failed wordpress login from 72.27.53.217 (JM/Jamaica/Kingston/Kingston/217-53-27-72-br1-DYNAMIC-dsl.cwjamaica.com/[redacted]): (CF_ENABLE)
Brute-Force
🇺🇸
TPI-Abuse
2026-10-13 10:10:21
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:225170) triggered by 72.27.53.217 (217-53-27-72-br1-DYNAMIC-dsl.cwjamaica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 06:10:15.044318 2026] [security2:error] [pid 19897:t ...
show more
(mod_security) mod_security (id:225170) triggered by 72.27.53.217 (217-53-27-72-br1-DYNAMIC-dsl.cwjamaica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 06:10:15.044318 2026] [security2:error] [pid 19897:tid 19897] [client 72.27.53.217:5091] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||brexitop.bamedica.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "brexitop.bamedica.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "as4Dh2pzMIiw4kjIwsFXPwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 05:27:59
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:225170) triggered by 72.27.53.217 (217-53-27-72-br1-DYNAMIC-dsl.cwjamaica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 01:27:54.000810 2026] [security2:error] [pid 15774:t ...
show more
(mod_security) mod_security (id:225170) triggered by 72.27.53.217 (217-53-27-72-br1-DYNAMIC-dsl.cwjamaica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 01:27:54.000810 2026] [security2:error] [pid 15774:tid 15790] [client 72.27.53.217:22493] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cjherbalremedies.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cjherbalremedies.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "as3BWWHbz5JLKGGFGzNyFQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Packets-Decreaser.NET
2026-10-12 15:20:52
UTC ·
(4 weeks ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
TPI-Abuse
2026-10-09 13:11:46
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 72.27.53.217 (217-53-27-72-br1-DYNAMIC-dsl.cwjamaica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 09:11:39.116871 2026] [security2:error] [pid 25969:t ...
show more
(mod_security) mod_security (id:225170) triggered by 72.27.53.217 (217-53-27-72-br1-DYNAMIC-dsl.cwjamaica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 09:11:39.116871 2026] [security2:error] [pid 25969:tid 25969] [client 72.27.53.217:53652] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||aandbnaturalfoods.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aandbnaturalfoods.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "asjoCx2-wLN9iZsiCs3-oQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇬
garrymenata
2026-08-23 18:12:17
UTC ·
(2 months ago)
72.27.53.217 - - [24/Aug/2026:00:46:39 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)"
72.27.53.217 - - [24/Aug/2026:00:46:41 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; A ...
show more
72.27.53.217 - - [24/Aug/2026:00:46:39 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)"
72.27.53.217 - - [24/Aug/2026:00:46:41 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)"
72.27.53.217 - - [24/Aug/2026:00:46:42 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)"
...
show less
DDoS Attack
Bad Web Bot
🇫🇷
Zkillu
2026-08-19 22:26:25
UTC ·
(2 months ago)
UDP flood (DDoS) vs AS215599: 149 pkts / 0.21 MB to UDP 80/8443 across 121 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised ho ...
show more
UDP flood (DDoS) vs AS215599: 149 pkts / 0.21 MB to UDP 80/8443 across 121 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
DDoS Attack
Exploited Host
