🇩🇪
MarkGGN
2026-11-08 00:02:18
UTC ·
(1 day ago)
Web attack. [1794005201] [0] [[HOST]] [#7893156] [0] [2] [79.53.85.26] [403] [GET] [/?rest_route=%2Fwp%2Fv2%2Fusers&_fields=slug&per_page=100&page=1] [User enumeration scan (REST API)] [hex:2f3f726573745f726f7574653d2532467770253246763225324675736572 ...
show more
Web attack. [1794005201] [0] [[HOST]] [#7893156] [0] [2] [79.53.85.26] [403] [GET] [/?rest_route=%2Fwp%2Fv2%2Fusers&_fields=slug&per_page=100&page=1] [User enumeration scan (REST API)] [hex:2f3f726573745f726f7574653d253246777025324676322532467573657273265f6669656c64733d736c7567267065725f706167653d31303026706167653d31]
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 00:29:43
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 79.53.85.26 (host-79-53-85-26.retail.telecomitalia.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 19:29:37.272937 2026] [security2:error] [pid 8319:tid 8 ...
show more
(mod_security) mod_security (id:225170) triggered by 79.53.85.26 (host-79-53-85-26.retail.telecomitalia.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 19:29:37.272937 2026] [security2:error] [pid 8319:tid 8319] [client 79.53.85.26:46494] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||daebakdesign.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "daebakdesign.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "au5w8YKPU743iwmHqluHSwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
MarkGGN
2026-11-06 22:46:44
UTC ·
(2 days ago)
Web attack. [1794005201] [0] [[HOST]] [#7893156] [0] [2] [79.53.85.26] [403] [GET] [/?rest_route=%2Fwp%2Fv2%2Fusers&_fields=slug&per_page=100&page=1] [User enumeration scan (REST API)] [hex:2f3f726573745f726f7574653d2532467770253246763225324675736572 ...
show more
Web attack. [1794005201] [0] [[HOST]] [#7893156] [0] [2] [79.53.85.26] [403] [GET] [/?rest_route=%2Fwp%2Fv2%2Fusers&_fields=slug&per_page=100&page=1] [User enumeration scan (REST API)] [hex:2f3f726573745f726f7574653d253246777025324676322532467573657273265f6669656c64733d736c7567267065725f706167653d31303026706167653d31] [1794005203] [0] [[HOST]] [#3276807] [0] [2] [79.53.85.26] [403] [GET] [/[HOST]?rest_route=%2Fwp%2Fv2%2Fusers&_fields=slug&per_page=100&page=1] [User enumeration scan (REST API)] [hex:2f696e6465782e7068703f726573745f726f7574653d253246777025324676322532467573657273265f6669656c64733d736c7567267065725f706167653d31303026706167653d31]
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 21:50:44
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 79.53.85.26 (host-79-53-85-26.retail.telecomitalia.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 16:50:40.981309 2026] [security2:error] [pid 22193:tid ...
show more
(mod_security) mod_security (id:225170) triggered by 79.53.85.26 (host-79-53-85-26.retail.telecomitalia.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 16:50:40.981309 2026] [security2:error] [pid 22193:tid 22193] [client 79.53.85.26:45666] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hotpay.co|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hotpay.co"] [uri "/wp-json/wp/v2/users"] [unique_id "au5LsB1GDttjsm-UF2cLfQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-11-06 01:10:01
UTC ·
(3 days ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-11-05 17:31:41
UTC ·
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 79.53.85.26 (host-79-53-85-26.retail.telecomitalia.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 12:31:34.944053 2026] [security2:error] [pid 2509666:ti ...
show more
(mod_security) mod_security (id:225170) triggered by 79.53.85.26 (host-79-53-85-26.retail.telecomitalia.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 12:31:34.944053 2026] [security2:error] [pid 2509666:tid 2510456] [client 79.53.85.26:33442] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||danelandia.aafm.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "danelandia.aafm.us"] [uri "/wp-json/wp/v2/users/me"] [unique_id "auy9dhckLfOiN4dL5D41cwAAAgY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TtlPst
2026-11-05 12:33:10
UTC ·
(3 days ago)
App probing / vulnerability scanning in path /wp-admin/admin-ajax.php
Web App Attack
Bad Web Bot
🇺🇸
lostswordfish.com
2026-11-05 07:54:05
UTC ·
(3 days ago)
Wordfence waf block on parsol
Web App Attack
🇩🇪
EGP Abuse Dept
2026-11-04 05:30:51
UTC ·
(4 days ago)
Scanning for web/db/file exploits on combinoord.nl
SQL Injection
Bad Web Bot
Web App Attack
🇵🇱
ChillScanner
2021-10-12 02:39:09
UTC ·
(5 years ago)
1 probe(s) @ TCP(22)
Port Scan
