🇩🇪
georgengelmann
2026-11-13 19:52:24
UTC ·
(1 day ago)
Failed login attempt for chenlinlin
Brute-Force
Web App Attack
🇩🇪
LRob
2026-11-13 13:14:36
UTC ·
(1 day ago)
Wordlist path sweep | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 | 2026-11-13 13:14 UTC
Port Scan
Web App Attack
🇩🇪
big-cloud.nl
2026-11-13 11:29:08
UTC ·
(1 day ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 09:26:37
UTC ·
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 85.247.32.32 (bl14-32-32.dsl.telepac.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:26:33.624436 2026] [security2:error] [pid 8531:tid 8531] [client 8 ...
show more
(mod_security) mod_security (id:210730) triggered by 85.247.32.32 (bl14-32-32.dsl.telepac.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:26:33.624436 2026] [security2:error] [pid 8531:tid 8531] [client 85.247.32.32:35546] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.genesis-castle.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.genesis-castle.com"] [uri "/totosupreme/lastupdate.log"] [unique_id "avbXyT3RYNfQZ8nQLESyZgAAAA4"], referer: https://www.genesis-castle.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 02:05:42
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 85.247.32.32 (bl14-32-32.dsl.telepac.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:05:37.889669 2026] [security2:error] [pid 13694:tid 13694] [client ...
show more
(mod_security) mod_security (id:225170) triggered by 85.247.32.32 (bl14-32-32.dsl.telepac.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:05:37.889669 2026] [security2:error] [pid 13694:tid 13694] [client 85.247.32.32:39994] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||campnecon.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "campnecon.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avZwcfQERJMINBMDuj8pfQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇭🇷
aktonrs
2026-11-12 13:40:25
UTC ·
(2 days ago)
Blocked by https://aegis.hr — HTTP Auth Brute Force - (MITRE T1110.001), 10 attempts, Period: 2026-11-12 13:14:42 to 2026-11-12 13:14:42
Web App Attack
Bad Web Bot
🇩🇪
LRob
2026-11-12 09:38:42
UTC ·
(2 days ago)
WordPress login brute force | path: /wp-login.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0 | 2026-11-12 09:38 UTC
Brute-Force
Web App Attack
🇫🇷
LRob
2026-11-11 10:03:56
UTC ·
(3 days ago)
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (X11; Linux x86_64; rv:148.0) Gecko/20100101 Firefox/148.0
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-11 00:38:42
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 85.247.32.32 (bl14-32-32.dsl.telepac.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:38:35.594777 2026] [security2:error] [pid 23916:tid 23916] [client ...
show more
(mod_security) mod_security (id:225170) triggered by 85.247.32.32 (bl14-32-32.dsl.telepac.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:38:35.594777 2026] [security2:error] [pid 23916:tid 23916] [client 85.247.32.32:59120] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||pearlhomesfw.anthonyanimalclinic.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "pearlhomesfw.anthonyanimalclinic.net"] [uri "/wp-json/wp/v2/users"] [unique_id "avO5C8YwwaEk_XhlsyK68AAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 00:13:18
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 85.247.32.32 (bl14-32-32.dsl.telepac.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:13:13.223171 2026] [security2:error] [pid 24704:tid 24704] [client ...
show more
(mod_security) mod_security (id:225170) triggered by 85.247.32.32 (bl14-32-32.dsl.telepac.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:13:13.223171 2026] [security2:error] [pid 24704:tid 24704] [client 85.247.32.32:55454] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||janyoors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "janyoors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avOzGeZaEk-Nzxwy-TIA5AAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇹
Information Security
2026-11-10 22:48:49
UTC ·
(4 days ago)
Web App Attack
...
Web App Attack
🇧🇷
Sipo Chutão
2026-11-09 03:00:01
UTC ·
(6 days ago)
/?rest_route=/wp/v2/users
Hacking
🇩🇪
big-cloud.nl
2026-11-08 21:20:30
UTC ·
(6 days ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
justbible
2026-11-08 13:39:39
UTC ·
(6 days ago)
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 38 requests from 2026-11-08T13:39:39+00:00 to 2026-11-11T12:42:21+00:00, e.g. 'GET /en/darby,web/job/10 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) A ...
show more
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 38 requests from 2026-11-08T13:39:39+00:00 to 2026-11-11T12:42:21+00:00, e.g. 'GET /en/darby,web/job/10 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested).
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-06 21:11:26
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 85.247.32.32 (bl14-32-32.dsl.telepac.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 16:11:20.854496 2026] [security2:error] [pid 12035:tid 12035] [client ...
show more
(mod_security) mod_security (id:225170) triggered by 85.247.32.32 (bl14-32-32.dsl.telepac.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 16:11:20.854496 2026] [security2:error] [pid 12035:tid 12035] [client 85.247.32.32:51938] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lakependoreillemobility.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lakependoreillemobility.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au5CeGaocgwJyF0Prm0HZwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
