🇺🇸
TPI-Abuse
2026-08-07 07:39:26
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 8.229.200.112 (112.200.229.8.bc.googleuserconte ...
show more
(mod_security) mod_security (id:225170) triggered by 8.229.200.112 (112.200.229.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 03:39:17.874392 2026] [security2:error] [pid 2512736:tid 2512736] [client 8.229.200.112:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||local639.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "local639.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "anWLpRIoFCxGi7pSZPOKDQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
Daniel Baer
2026-08-07 07:30:04
(2 weeks ago)
CrowdSec local HTTP alert
scenario: crowdsecurity/http-probing
alert_id: 3068
events: 11
created_at: ...
show more
CrowdSec local HTTP alert
scenario: crowdsecurity/http-probing
alert_id: 3068
events: 11
created_at: 2026-08-07T07:28:54Z
message: Ip 8.229.200.112 performed 'crowdsecurity/http-probing' (11 events over 1.851893403s) at 2026-08-07 07:28:53.485322292 +0000 UTC
target_uri: ["//wp-includes/ID3/license.txt","//feed/","//xmlrpc.php?rsd","//blog/wp-includes/wlwmanifest.xml","//web/wp-includes/wlwmanifest.xml","//wordpress/wp-includes/wlwmanifest.xml","//wp/wp-includes/wlwmanifest.xml","//2020/wp-includes/wlwmanifest.xml","//2019/wp-includes/wlwmanifest.xml","//2021/wp-includes/wlwmanifest.xml","//shop/wp-includes/wlwmanifest.xml"]
method: ["GET"]
status: ["404"]
user_agent: ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"]
show less
Bad Web Bot
Web App Attack
🇩🇪
abdubhai
2026-08-07 07:28:30
(2 weeks ago)
8.229.200.112 - - [07/Aug/2026:1
...
Brute-Force
🇦🇺
Lazarus
2026-08-07 07:25:32
(2 weeks ago)
HTTP probe.
Web App Attack
🇧🇾
lns.bz
2026-08-07 07:14:30
(2 weeks ago)
Too many 404 requests [BY]
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-08-07 07:13:14
(2 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇧🇪
cmbplf
2026-08-07 07:03:11
(2 weeks ago)
6.325 post requests in 1 hour (2d4h20m)
Brute-Force
Bad Web Bot
🇩🇪
Blexyel
2026-08-07 07:01:04
(2 weeks ago)
8.229.200.112 - - [07/Aug/2026:09:01:03 +0200] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 ...
show more
8.229.200.112 - - [07/Aug/2026:09:01:03 +0200] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 120 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
...
show less
Brute-Force
Web App Attack
🇳🇱
Savvii
2026-08-07 06:49:32
(2 weeks ago)
10 attempts against mh-misc-ban on ethyl
Web App Attack
🇮🇹
VHosting
2026-08-07 06:45:03
(2 weeks ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇨🇦
polycoda
2026-08-07 06:44:57
(2 weeks ago)
AutoBlock: 🔐 WordPress Login Brute Force (20X or 30X) (Decay-Based) - ↪️ Excessive 30X Errors (Decay ...
show more
AutoBlock: 🔐 WordPress Login Brute Force (20X or 30X) (Decay-Based) - ↪️ Excessive 30X Errors (Decay-Based)
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇱
n33
2026-08-07 06:44:56
(2 weeks ago)
Attack detected detected by fail2ban. Service: nginx-ghost-upstream. Banned after 3 failed attempts.
Hacking
Web App Attack
🇨🇭
Origon
2026-08-07 06:43:10
(2 weeks ago)
http-probing - IP: 8.229.200.112 - time="2026-08-07T08:43:09+02:00" level=info msg="(555f66b4f6a745 ...
show more
http-probing - IP: 8.229.200.112 - time="2026-08-07T08:43:09+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-probing by ip 8.229.200.112 (US/396982) : 4h ban on Ip 8.229.200.112" module=db
show less
Web App Attack
🇷🇺
DZBOT
2026-08-07 06:39:32
(2 weeks ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 06:38:01
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 8.229.200.112 (112.200.229.8.bc.googleuserconte ...
show more
(mod_security) mod_security (id:225170) triggered by 8.229.200.112 (112.200.229.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 02:37:54.205803 2026] [security2:error] [pid 1413337:tid 1413337] [client 8.229.200.112:58296] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lukeschicago.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lukeschicago.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "anV9Qtpv_dso9qqs295VPQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack