2026-11-13 10:37:54
UTC ·
(8 hours ago)
POST /xmlrpc.php HTTP/1.1
...
Brute-Force
🇺🇸
TPI-Abuse
2026-11-13 03:09:00
UTC ·
(16 hours ago)
(mod_security) mod_security (id:225170) triggered by 85.130.202.163 (bzq-85-130-202-163.static-ip.bezeqint.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 22:08:53.110409 2026] [security2:error] [pid 25299: ...
show more
(mod_security) mod_security (id:225170) triggered by 85.130.202.163 (bzq-85-130-202-163.static-ip.bezeqint.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 22:08:53.110409 2026] [security2:error] [pid 25299:tid 25299] [client 85.130.202.163:57204] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||justiart.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "justiart.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avZ_RT2vTtU_GlOjuOq48AAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-11-11 20:35:57
UTC ·
(1 day ago)
[WedNov1121:35:50.4890122026][security2:error][pid2299667:tid2299802][client85.130.202.163:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\ ...
show more
[WedNov1121:35:50.4890122026][security2:error][pid2299667:tid2299802][client85.130.202.163:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"mondo-it.ch\"][uri\"/xmlrpc.php\"][unique_id\"avTRpls-hKnrxiTzJrrqewAAARA\"]
show less
Hacking
Web App Attack
🇺🇸
mnsf
2026-11-10 13:05:04
UTC ·
(3 days ago)
Abuse Detected (9)
Brute-Force
Web App Attack
🇩🇪
LRob
2026-11-10 10:30:27
UTC ·
(3 days ago)
Web exploit attempt | method: GET | path: /wp-json/wp/v2/users | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Hacking
Web App Attack
🇺🇦
URAN Publishing Service
2026-11-10 10:19:56
UTC ·
(3 days ago)
[10/Nov/2026:12:19:56 +0200] -- 85.130.202.163 Ban reason: Scanner [CMS_GENERIC] | Request: GET /wp-json/buddypress/v1/members?_fields=user_login&per_page=100&page=1 HTTP/1.1
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 07:51:41
UTC ·
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 85.130.202.163 (bzq-85-130-202-163.static-ip.bezeqint.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 02:51:34.507818 2026] [security2:error] [pid 28253: ...
show more
(mod_security) mod_security (id:225170) triggered by 85.130.202.163 (bzq-85-130-202-163.static-ip.bezeqint.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 02:51:34.507818 2026] [security2:error] [pid 28253:tid 28253] [client 85.130.202.163:34044] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hsoftwaresystems.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hsoftwaresystems.net"] [uri "/wp-json/wp/v2/users"] [unique_id "avLNBv25LpxWLuc9b8cK_wAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-11-07 18:43:58
UTC ·
(6 days ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-login-lockdown-high.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 01:58:20
UTC ·
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 85.130.202.163 (bzq-85-130-202-163.static.bezeqint.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 20:58:12.510742 2026] [security2:error] [pid 2876:tid ...
show more
(mod_security) mod_security (id:225170) triggered by 85.130.202.163 (bzq-85-130-202-163.static.bezeqint.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 20:58:12.510742 2026] [security2:error] [pid 2876:tid 2876] [client 85.130.202.163:50972] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||greenmountainfeeds.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "greenmountainfeeds.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au6FtNQKUYV9X2F6UelbBQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-11-06 10:46:45
UTC ·
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 24
Exploited Host
Web App Attack
🇩🇪
nyuuzyou
2026-11-05 11:33:07
UTC ·
(1 week ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-11-05T11:33:07Z.
Bad Web Bot
🇨🇿
lp
2026-11-05 08:33:08
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 85.130.202.163
2026-11-05T09:13:33+0100 vpn Access-Reject station: 85.130.202.163
Brute-Force
Web App Attack
🇫🇷
ingroscart.it
2026-11-05 05:04:58
UTC ·
(1 week ago)
(wordpress) Failed wordpress login from 85.130.202.163 (IL/Israel/Tel Aviv/Tel Aviv/bzq-85-130-202-163.static-ip.bezeqint.net/[redacted])
Brute-Force
🇺🇸
lostswordfish.com
2026-11-04 20:44:04
UTC ·
(1 week ago)
Wordfence waf block on parsol
Web App Attack
🇨🇿
lp
2026-11-04 20:03:32
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 85.130.202.163
2026-11-04T20:49:14+0100 vpn Access-Reject station: 85.130.202.163
Brute-Force
Web App Attack
