🇩🇪
Lino Project
2026-06-20 17:04:17
(8 hours ago)
88.218.44.96 - - [20/Jun/2026:19:04:16 +0200] "GET /wp-admin/post-new.php HTTP/1.1" 403 3392 "-" "Mo ...
show more
88.218.44.96 - - [20/Jun/2026:19:04:16 +0200] "GET /wp-admin/post-new.php HTTP/1.1" 403 3392 "-" "Mozilla/5.0 (Linux; Android 10; Mi A3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.111 Mobile Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Lino Project
2026-06-16 07:21:48
(4 days ago)
88.218.44.96 - - [16/Jun/2026:09:21:48 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3987 "-" "Mozilla/5.0 ...
show more
88.218.44.96 - - [16/Jun/2026:09:21:48 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3987 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 15:40:34
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 11:40:29.831018 2026] [security2:error] [pid 18124:tid 18124] [client 88.218.44.96:16477] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bruskiewitz.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bruskiewitz.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajAc7fG8TlWK_tEM8RODaAAAAAA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Lino Project
2026-06-15 12:35:29
(5 days ago)
88.218.44.96 - - [15/Jun/2026:14:35:28 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3987 "-" "Mozilla/5.0 ...
show more
88.218.44.96 - - [15/Jun/2026:14:35:28 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3987 "-" "Mozilla/5.0 (Linux; Android 7.0; P00A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 20:26:08
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 16:26:03.465577 2026] [security2:error] [pid 4091:tid 4091] [client 88.218.44.96:20041] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ejnes.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ejnes.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aih22zACJDw5eCA7A8zB0wAAAAU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
inlink.ltd
2026-06-02 18:31:53
(2 weeks ago)
Known malicious PHP file or CMS probe
Web App Attack
🇺🇸
TPI-Abuse
2026-05-28 03:54:37
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 23:54:34.108774 2026] [security2:error] [pid 22487:tid 22487] [client 88.218.44.96:17153] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||wallpaperpro.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "wallpaperpro.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahe8erUAL3ZYh65czYWL5QAAAAc"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-05-22 14:33:48
(4 weeks ago)
Web password guessing
Brute-Force
🇺🇸
TPI-Abuse
2026-05-11 08:18:54
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 04:18:50.888189 2026] [security2:error] [pid 24570:tid 24570] [client 88.218.44.96:61039] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fisseq.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fisseq.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agGQ6vJA3RQZVXwG-s5l8wAAABU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-29 12:00:09
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 08:00:02.625924 2026] [security2:error] [pid 18414:tid 18414] [client 88.218.44.96:46735] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.alianzafreight.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.alianzafreight.com"] [uri "/s3cmd.ini"] [unique_id "afHywo9329NsAJRNwmUcnQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-29 04:54:29
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 00:54:23.729762 2026] [security2:error] [pid 6149:tid 6247] [client 88.218.44.96:19251] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sea2er.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sea2er.com"] [uri "/s3cmd.ini"] [unique_id "afGO_7wtPHHiT3tRKRTKWwAAAcQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-26 15:46:49
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 11:46:41.052094 2026] [security2:error] [pid 835:tid 835] [client 88.218.44.96:28549] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sparkleluminous.com.nashuaboyscouts.org|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sparkleluminous.com.nashuaboyscouts.org"] [uri "/s3cmd.ini"] [unique_id "ae4zYSzPr6Z_y2LpfLX1LQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-26 08:41:06
(1 month ago)
(mod_security) mod_security (id:210831) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210831) triggered by 88.218.44.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 04:40:59.884780 2026] [security2:error] [pid 3589:tid 3589] [client 88.218.44.96:30337] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||travelimts.com|F|4"] [data "Web Downloader"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "travelimts.com"] [uri "/.aws/credentials"] [unique_id "ae3Pm88sPWjtboqP1BDyQgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-12-11 01:58:21
(6 months ago)
Attempted brute force login to web vpn 2 time(s); last attempt for 2025.12.11 is noted in report tim ...
show more
Attempted brute force login to web vpn 2 time(s); last attempt for 2025.12.11 is noted in report timestamp
show less
Hacking
Brute-Force
🇺🇸
PacificCore
2025-10-27 20:39:30
(7 months ago)
RdpGuard detected brute-force attempt on RD-WEB
Brute-Force