๐ฎ๐ณ
evicky2002
2026-09-17 06:00:05
(4 weeks ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
๐ฉ๐ช
mondor.ro
2026-09-16 11:12:21
(1 month ago)
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 8.234.187.6, Reason:[( ...
show more
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 8.234.187.6, Reason:[(manifest) WordPress wlwmanifest.xml Attack 8.234.187.6 (US/United States/6.187.234.8.bc.googleusercontent.com): 10 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs:
show less
Port Scan
๐ฎ๐น
CoreTech srl
2026-09-16 11:08:57
(1 month ago)
cloudlinux2 fail2ban: 2026-09-16 13:03:56,992 fail2ban.filter [1818]: INFO [plesk-wordpre ...
show more
cloudlinux2 fail2ban: 2026-09-16 13:03:56,992 fail2ban.filter [1818]: INFO [plesk-wordpress] Found 178.168.230.108 - 2026-09-16 13:03:56cloudlinux2 fail2ban: 2026-09-16 13:04:25,762 fail2ban.filter [1818]: INFO [plesk-wordpress] Found 136.144.42.146 - 2026-09-16 13:04:25cloudlinux2 fail2ban: 2026-09-16 13:04:37,863 fail2ban.filter [1818]: INFO [plesk-wordpress] Found 185.223.152.143 - 2026-09-16 13:04:37cloudlinux2 fail2ban: 2026-09-16 13:05:14,513 fail2ban.filter [1818]: INFO [plesk-modsecurity] Found 78.180.58.17 - 2026-09-16 13:05:14cloudlinux2 fail2ban: 2026-09-16 13:05:11,458 fail2ban.filter [1818]: INFO [plesk-wordpress] Found 87.248.161.23 - 2026-09-16 13:05:11cloudlinux2 fail2ban: 2026-09-16 13:06:09,600 fail2ban.filter [1818]: INFO [plesk-modsecurity] Found 8.234.187.6 - 2026-09-16 13:06:09cloudlinux2 fail2ban: 2026-09-16 13:06:14,028 fail2ban.filter [1818]: INFO [plesk-wordpress] Found 193.36.224.30 - 2026-09-16 13:06:13clo
show less
Web App Attack
๐ฉ๐ช
joharikop
2026-09-16 11:08:16
(1 month ago)
Malformed HTTP request or known bad user agent detected by fail2ban on nginx reverse proxy
Bad Web Bot
๐บ๐ธ
TPI-Abuse
2026-09-16 11:06:34
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 8.234.187.6 (6.187.234.8.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:225170) triggered by 8.234.187.6 (6.187.234.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 07:06:21.864064 2026] [security2:error] [pid 26540:tid 26540] [client 8.234.187.6:52618] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.modalguitarist.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.modalguitarist.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aqp4LRDMPs3CNqN-dSQO5gAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฉ๐ช
ger-stg-sifi1
2026-09-16 10:58:42
(1 month ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
๐ซ๐ท
Stara
2026-09-16 10:55:37
(1 month ago)
Automated block - Joomla/WordPress/OpenCart vulnerability scanner exploitation detected (Mala Kinesk ...
show more
Automated block - Joomla/WordPress/OpenCart vulnerability scanner exploitation detected (Mala Kineskinja)
show less
Hacking
Brute-Force
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-16 10:49:10
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 8.234.187.6 (6.187.234.8.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:225170) triggered by 8.234.187.6 (6.187.234.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 06:49:03.766930 2026] [security2:error] [pid 21137:tid 21137] [client 8.234.187.6:62125] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.microkerneltechnologies.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.microkerneltechnologies.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aqp0H-X1lTOGL43NhPJxDAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐จ๐ญ
backslash
2026-09-16 10:48:00
(1 month ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
๐ฉ๐ช
LRob
2026-09-16 10:37:55
(1 month ago)
Malicious web request: probing for secrets, traversal or a known exploit path | method: GET | path: ...
show more
Malicious web request: probing for secrets, traversal or a known exploit path | method: GET | path: // | query: author=1 (+1 more) | 2026-09-16 10:37 UTC
show less
Hacking
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-16 10:32:34
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 8.234.187.6 (6.187.234.8.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:225170) triggered by 8.234.187.6 (6.187.234.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 06:32:27.745943 2026] [security2:error] [pid 2499073:tid 2499073] [client 8.234.187.6:56029] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mdivietnam.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mdivietnam.com"] [uri "/wordpress/wp-json/wp/v2/users/"] [unique_id "aqpwO07lKRwHzFwgi8HShAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฉ๐ช
pltcldvlpr
2026-09-16 10:32:27
(1 month ago)
CMS/framework probe: 8.234.187.6 - - [16/Sep/2026:12:32:27 +0200] "GET //wp-includes/wlwmanifest.xml ...
show more
CMS/framework probe: 8.234.187.6 - - [16/Sep/2026:12:32:27 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" asn=396982 org="Google LLC" country=US
...
show less
Web App Attack
๐ฉ๐ช
hollowmatt
2026-09-16 10:24:45
(1 month ago)
CrowdSec detection | scenario: http-probing
Port Scan
Web App Attack
๐ฉ๐ช
Petros Stefanakis
2026-09-16 10:23:31
(1 month ago)
(mod_security,wordpress) Login failure/trigger from 8.234.187.6 (US/United States/6.187.234.8.bc.goo ...
show more
(mod_security,wordpress) Login failure/trigger from 8.234.187.6 (US/United States/6.187.234.8.bc.googleusercontent.com)
show less
SQL Injection
Brute-Force
๐ฉ๐ช
ghostwarriors
2026-09-16 10:20:08
(1 month ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack