🇫🇮
stinpriza
2025-10-17 09:34:05
(7 months ago)
Web App Attack
Web App Attack
🇩🇪
LRob.fr
2025-10-16 11:04:06
(7 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇫🇮
FlexPete
2025-10-15 23:59:59
(8 months ago)
Web related brute force 20251015
Hacking
Brute-Force
Web App Attack
2025-09-28 18:40:19
(8 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-09-28 01:53:20
(8 months ago)
91.216.34.14 - - [28/Sep/2025:03:53:18 +0200] "POST /xmlrpc.php HTTP/2.0" 403 153 "-" "Mozilla/5.0 ( ...
show more
91.216.34.14 - - [28/Sep/2025:03:53:18 +0200] "POST /xmlrpc.php HTTP/2.0" 403 153 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:48.0) Gecko/20100101 Firefox/48.0"
show less
Web App Attack
🇺🇸
myagent.site
2025-09-27 22:51:59
(8 months ago)
Blocking for trying to access an exploit file: /xmlrpc.php
Hacking
2025-09-24 19:06:39
(8 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
mnsf
2025-07-29 15:05:11
(10 months ago)
Too many Status 40X (18)
Scanning/Probing (18)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-07-29 07:42:39
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 91.216.34.14 (web14.websiteondemand.nl): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 91.216.34.14 (web14.websiteondemand.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 29 03:42:31.949534 2025] [security2:error] [pid 19703:tid 19703] [client 91.216.34.14:40714] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||swingboutique.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "swingboutique.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aIh7Z9pKNbm5UjTYmVtFOwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
masterguru
2025-07-29 07:42:35
(10 months ago)
COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487). Operato ...
show more
COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. (225170-169)
show less
Hacking
Web App Attack
🇺🇸
mnsf
2025-07-28 14:05:35
(10 months ago)
Too many Status 40X (12)
Scanning/Probing (12)
Brute-Force
Web App Attack
2025-07-28 10:16:42
(10 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-07-03 14:28:25
(11 months ago)
(mod_security) mod_security (id:225170) triggered by 91.216.34.14 (web14.websiteondemand.nl): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 91.216.34.14 (web14.websiteondemand.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 03 10:28:21.047369 2025] [security2:error] [pid 8247:tid 8247] [client 91.216.34.14:59876] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.spacebooger.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.spacebooger.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aGaThVYeAW9N7gcOQO4XzAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-02 07:48:03
(11 months ago)
(mod_security) mod_security (id:225170) triggered by 91.216.34.14 (web14.websiteondemand.nl): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 91.216.34.14 (web14.websiteondemand.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 02 03:47:58.602516 2025] [security2:error] [pid 2186:tid 2186] [client 91.216.34.14:36098] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.prostar.industries|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.prostar.industries"] [uri "/wp-json/wp/v2/users"] [unique_id "aGTkLlx9pG8p7g7cFDL7ogAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2025-07-01 14:33:27
(11 months ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
NL/Netherlands/web14.websiteondemand.nl
Web App Attack