🇺🇸
TPI-Abuse
2026-09-05 17:33:24
(1 hour ago)
(mod_security) mod_security (id:225170) triggered by 89.252.139.20 (curie.ishostname.com): 1 in the ...
show more
(mod_security) mod_security (id:225170) triggered by 89.252.139.20 (curie.ishostname.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 13:33:20.318807 2026] [security2:error] [pid 13033:tid 13033] [client 89.252.139.20:37888] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lgbtqhistoryinaustin.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lgbtqhistoryinaustin.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "apxSYKkloQadOPl7E4Q2_AAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-09-05 16:05:04
(2 hours ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇩🇪
LRob
2026-09-05 15:45:11
(2 hours ago)
WordPress login brute-force | path: /wp-login.php | 2026-09-05 15:45 UTC
Brute-Force
Web App Attack
🇦🇺
QT
2026-09-05 15:24:32
(3 hours ago)
Unauthorised WordPress admin login attempted at 2026-09-06 01:24:26 +1000
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 15:17:09
(3 hours ago)
(mod_security) mod_security (id:225170) triggered by 89.252.139.20 (curie.ishostname.com): 1 in the ...
show more
(mod_security) mod_security (id:225170) triggered by 89.252.139.20 (curie.ishostname.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 11:17:03.845287 2026] [security2:error] [pid 23600:tid 23600] [client 89.252.139.20:58184] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||soereng.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "soereng.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "apwyb-0pcvdESB292RZwzQAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-09-05 15:06:44
(3 hours ago)
12.372 requests to many distinct domains in 1 hour (2w4d14h)
Brute-Force
Bad Web Bot
🇩🇪
Marc
2026-09-05 14:57:38
(3 hours ago)
89.252.139.20 - - [05/Sep/2026:15:36:28 +0200] "GET /wp-login.php HTTP/2.0" 200 3450 "-" "Mozilla/5. ...
show more
89.252.139.20 - - [05/Sep/2026:15:36:28 +0200] "GET /wp-login.php HTTP/2.0" 200 3450 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 89.252.139.20 - - [05/Sep/2026:15:36:29 +0200] "POST /wp-login.php HTTP/2.0" 200 3288 "https://alsarnsberg.de/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 89.252.139.20 - - [05/Sep/2026:15:39:30 +0200] "GET /wp-login.php HTTP/2.0" 200 16175 "https://wasch-arena.de/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 89.252.139.20 - - [05/Sep/2026:15:39:31 +0200] "GET /wp-login.php HTTP/2.0" 200 15872 "https://wasch-arena.de/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 89.252.139.20 - - [05/Sep/2026:16:57:37 +0200] "GET /wp-login.php HTTP/2.0" 200 3450 "-" "Mozilla/5.0 (Wind
show less
Brute-Force
Web App Attack
🇩🇪
AlexEventfahrtenIPDB
2026-09-05 14:38:47
(4 hours ago)
[Sat Sep 05 16:38:46.612572 2026] [authz_core:error] [pid 2860871:tid 2860878] [remote 89.252.139.20 ...
show more
[Sat Sep 05 16:38:46.612572 2026] [authz_core:error] [pid 2860871:tid 2860878] [remote 89.252.139.20:54120] AH01630: client denied by server configuration: /var/www/std-sites/cadillac/wp-login.php
[Sat Sep 05 16:38:46.917922 2026] [authz_core:error] [pid 2860871:tid 2860880] [remote 89.252.139.20:46602] AH01630: client denied by server configuration: /var/www/std-sites/cadillac/wp-login.php, referer: https://powerstar.spdns.de/wp-login.php
...
show less
Brute-Force
Web App Attack
🇫🇷
masterguru
2026-09-05 14:31:57
(4 hours ago)
(wordpress) Apache: Failed WordPress login from 89.252.139.20 (TR/Turkey/curie.ishostname.com): 10 i ...
show more
(wordpress) Apache: Failed WordPress login from 89.252.139.20 (TR/Turkey/curie.ishostname.com): 10 in the last 3600 secs (0-193)
show less
Hacking
🇺🇸
TPI-Abuse
2026-09-05 14:29:00
(4 hours ago)
(mod_security) mod_security (id:225170) triggered by 89.252.139.20 (curie.ishostname.com): 1 in the ...
show more
(mod_security) mod_security (id:225170) triggered by 89.252.139.20 (curie.ishostname.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 10:28:53.942296 2026] [security2:error] [pid 2808491:tid 2808491] [client 89.252.139.20:41322] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mytapt.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mytapt.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "apwnJRjYIw7qsHfvLMPmZwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
lostswordfish.com
2026-09-05 14:26:03
(4 hours ago)
Wordfence waf block on wp20190711M4
Web App Attack
🇳🇱
maxxsense
2026-09-05 14:25:38
(4 hours ago)
(wordpress) Failed wordpress login from 89.252.139.20 (TR/Türkiye/curie.ishostname.com)
Brute-Force
🇩🇪
neckaralb-admin.de
2026-09-05 14:22:14
(4 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇫🇷
dynamix
2026-09-05 14:21:57
(4 hours ago)
WordPress wp-login.php Brute Force Attack
Brute-Force
Web App Attack
🇷🇴
SpamStopper
2026-09-05 14:17:09
(4 hours ago)
Fail2Ban - WP Spoofing
Port Scan
Brute-Force
Web App Attack