84.17.43.81

Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ... show more Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Rate limit bad session: 3 in 2s | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1; rv:121.0) Gecko/20100101 Firefox/121.0 | (Magento Site) show less

2026/08/10 14:00:45 [error] 1967685#1967685: *464968074 access forbidden by rule, client: 84.17.43.81, server: binixo.com, request: "GET /wp-login.php HTTP/2.0", host: "binixo.com", referrer: "https://www.facebook.com/" 2026/08/10 14:00:45 [error] 19 ... show more 2026/08/10 14:00:45 [error] 1967685#1967685: *464968074 access forbidden by rule, client: 84.17.43.81, server: binixo.com, request: "GET /wp-login.php HTTP/2.0", host: "binixo.com", referrer: "https://www.facebook.com/" 2026/08/10 14:00:45 [error] 1967682#1967682: *464968085 access forbidden by rule, client: 84.17.43.81, server: binixo.com, request: "GET /wp-login.php HTTP/2.0", host: "binixo.com", referrer: "https://t.co/" 2026/08/10 14:00:45 [error] 1967682#1967682: *464968091 access forbidden by rule, client: 84.17.43.81, server: binixo.com, request: "GET /wp-admin/ HTTP/2.0", host: "binixo.com", referrer: "https://www.google.com/search?q=wordpress" ... show less

8.351 requests in 1 hour (1mo3w3d)

Repeated wp-login/xmlrpc attempts

CrowdSec: crowdsecurity/http-bf-wordpress_bf | req: /wp-login.php | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36

AetherFox VoidGuard detected: [Fri Aug 07 22:15:27.480541 2026] [authz_core:error] [pid 13873:tid 13903] [client 84.17.43.81:50302] AH01630: client denied by server configuration: proxy:https://136.243.123.86/wp-login.php [Fri Aug 07 22:15:27.480756 ... show more AetherFox VoidGuard detected: [Fri Aug 07 22:15:27.480541 2026] [authz_core:error] [pid 13873:tid 13903] [client 84.17.43.81:50302] AH01630: client denied by server configuration: proxy:https://136.243.123.86/wp-login.php [Fri Aug 07 22:15:27.480756 2026] [authz_core:error] [pid 13873:tid 13903] [client 84.17.43.81:50302] AH01630: client denied by server configuration: /var/www/ERRORpages/403.html [Fri Aug 07 22:15:27.554910 2026] [authz_core:error] [pid 13873:tid 13927] [client 84.17.43.81:50302] AH01630: client denied by server configuration: proxy:https://136.243.123.86/wp-admin/, referer: https://www.google.com/ [Fri Aug 07 22:15:27.555102 2026] [authz_core:error] [pid 13873:tid 13927] [client 84.17.43.81:50302] AH01630: client denied by server configuration: /var/www/ERRORpages/403.html, referer: https://www.google.com/ [Fri Aug 07 22:15:27.529803 2026] [authz_core:error] [pid 13873:tid 13908] [client 84.17.43.81:50303] AH01630: client denied by server configur ... show less

Excessive failed CAPTCHA attempts (CAPTCHA DoS)

(mod_security) mod_security (id:225170) triggered by 84.17.43.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 05 16:09:14.024924 2026] [security2:error] [pid 20257:tid 20257] [client 84.17.43.81:64027] ModSe ... show more (mod_security) mod_security (id:225170) triggered by 84.17.43.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 05 16:09:14.024924 2026] [security2:error] [pid 20257:tid 20257] [client 84.17.43.81:64027] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||192.64.151.15|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "192.64.151.15"] [uri "/wp-json/wp/v2/users"] [unique_id "anOYanQgpIxWhBbA_y9LuwAAAAQ"], referer: https://wordpress.org/ show less

WP Author Enumeration

14.150 requests in 1 hour (6d5h59m)

CMS (WordPress or Joomla) brute force attempt.

Bot / scanning and/or hacking attempts: POST /wp-login.php HTTP/1.1, GET /wp-admin/edit.php HTTP/1.1, GET /wp-login.php?redirect_to=https%3A%2F%2Fefidenz.nl%2Fwp-adm, GET /wp-admin/index.php HTTP/1.1, GET /wp-admin/profile.php HTTP/1.1, GET /wp-admin ... show more Bot / scanning and/or hacking attempts: POST /wp-login.php HTTP/1.1, GET /wp-admin/edit.php HTTP/1.1, GET /wp-login.php?redirect_to=https%3A%2F%2Fefidenz.nl%2Fwp-adm, GET /wp-admin/index.php HTTP/1.1, GET /wp-admin/profile.php HTTP/1.1, GET /wp-admin/plugins.php HTTP/1.1 show less

Multiple WAF Violations

block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8

WP probing for vulnerabilities