🇺🇸
micropedro
2026-09-29 23:18:09
(3 days ago)
4 incidents: malicious activity. First: 2026-09-29 18:52, Last: 2026-09-29 19:18 UTC. Triggers: unkn ...
show more
4 incidents: malicious activity. First: 2026-09-29 18:52, Last: 2026-09-29 19:18 UTC. Triggers: unknown.
show less
Port Scan
🇺🇸
RAP
2026-09-26 07:44:18
(1 week ago)
2026-09-26 07:44:18 UTC Unauthorized activity to TCP port 22. SSH
SSH
🇹🇷
Domainhizmetleri.com
2026-09-26 06:13:06
(1 week ago)
Source: DH Hunter (Honeypot) | Reason: Portscan (1 ports, 1 attempts in 480h, non-TR)
Port Scan
🇺🇸
TPI-Abuse
2026-09-26 05:42:00
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 91.211.138.22 (91-211-138-22.dynamic-pool.mclau ...
show more
(mod_security) mod_security (id:225170) triggered by 91.211.138.22 (91-211-138-22.dynamic-pool.mclaut.cc): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 01:41:56.063117 2026] [security2:error] [pid 25377:tid 25377] [client 91.211.138.22:41754] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lawrencehale.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lawrencehale.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ardbJOo5MqcDDHgaa4np8gAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
thefuzz4
2026-09-26 05:18:22
(1 week ago)
SSH tarpit (endlessh): 2 unsolicited connection(s) to port 22. Automated report.
Brute-Force
SSH
🇫🇮
stinpriza
2026-09-26 04:09:58
(1 week ago)
WP Authentication attempt for unknown user
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-26 03:32:47
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 91.211.138.22 (91-211-138-22.dynamic-pool.mclau ...
show more
(mod_security) mod_security (id:225170) triggered by 91.211.138.22 (91-211-138-22.dynamic-pool.mclaut.cc): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 23:32:43.196145 2026] [security2:error] [pid 25863:tid 25863] [client 91.211.138.22:41170] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||n4fh.cosentient.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "n4fh.cosentient.com"] [uri "/wp-json/wp/v2/users"] [unique_id "arc82wRmDGiUhBr63tyZIAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
micropedro
2026-09-26 02:11:13
(1 week ago)
3 incidents: port scanning. First: 2026-09-25 22:11, Last: 2026-09-25 22:11 UTC. Triggers: firewall- ...
show more
3 incidents: port scanning. First: 2026-09-25 22:11, Last: 2026-09-25 22:11 UTC. Triggers: firewall-tcp,port-trap,non-public-port.
show less
Port Scan
🇺🇸
TPI-Abuse
2026-09-26 02:02:44
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 91.211.138.22 (91-211-138-22.dynamic-pool.mclau ...
show more
(mod_security) mod_security (id:225170) triggered by 91.211.138.22 (91-211-138-22.dynamic-pool.mclaut.cc): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 22:02:38.455302 2026] [security2:error] [pid 1353:tid 1353] [client 91.211.138.22:39196] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||starvationacres.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "starvationacres.us"] [uri "/wp-json/wp/v2/users"] [unique_id "arcnviCelSLvm7sLs4h9MQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-09-26 00:37:54
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
2026-09-25 23:28:29
(1 week ago)
denied SSH access attempt. destination port 22.
Port Scan
Brute-Force
SSH
🇩🇪
_ArminS_
2026-09-25 23:03:46
(1 week ago)
SP-Scan 54270:23 detected 2026.09.26 01:03:46
blocked until 2026.11.14 17:06:33
Port Scan
2026-09-25 20:53:52
(1 week ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
RAP
2026-09-25 19:19:52
(1 week ago)
2026-09-25 19:19:52 UTC Unauthorized activity to TCP port 23. Telnet
Port Scan
🇺🇸
TPI-Abuse
2026-09-25 17:28:19
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 91.211.138.22 (91-211-138-22.dynamic-pool.mclau ...
show more
(mod_security) mod_security (id:225170) triggered by 91.211.138.22 (91-211-138-22.dynamic-pool.mclaut.cc): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 13:28:14.060152 2026] [security2:error] [pid 11941:tid 11941] [client 91.211.138.22:43184] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||qed-consulting.co|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "qed-consulting.co"] [uri "/wp-json/wp/v2/users"] [unique_id "aravLlef0CZ5xVObeZWyeAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
