🇺🇸
TPI-Abuse
2026-11-10 12:01:50
UTC ·
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 91.254.3.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 07:01:44.412160 2026] [security2:error] [pid 16449:tid 16449] [client 91.254.3.160:33660] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 91.254.3.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 07:01:44.412160 2026] [security2:error] [pid 16449:tid 16449] [client 91.254.3.160:33660] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jerielster.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jerielster.com"] [uri "/wp/wp-json/wp/v2/users"] [unique_id "avMHqP7AHu94e3heDZI9UQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 09:59:40
UTC ·
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 91.254.3.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:59:35.791478 2026] [security2:error] [pid 31149:tid 31149] [client 91.254.3.160:47258] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 91.254.3.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:59:35.791478 2026] [security2:error] [pid 31149:tid 31149] [client 91.254.3.160:47258] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||riccardiagency.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "riccardiagency.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avLrB9ryi4g_r5CaEPhBkQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 08:50:57
UTC ·
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 91.254.3.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:50:52.136391 2026] [security2:error] [pid 30600:tid 30600] [client 91.254.3.160:60896] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 91.254.3.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:50:52.136391 2026] [security2:error] [pid 30600:tid 30600] [client 91.254.3.160:60896] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||inverzona.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "inverzona.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avLa7I7zGMDPJuGbuxiDEgAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Bedios GmbH
2026-11-10 05:02:23
UTC ·
(3 days ago)
Excessive probing of non-existent URLs
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-10 03:42:59
UTC ·
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 91.254.3.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:42:52.550856 2026] [security2:error] [pid 885:tid 885] [client 91.254.3.160:55784] ModSecu ...
show more
(mod_security) mod_security (id:225170) triggered by 91.254.3.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:42:52.550856 2026] [security2:error] [pid 885:tid 885] [client 91.254.3.160:55784] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||starcrestsales.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "starcrestsales.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avKSvM_D67XDbROwLeSxYwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-08 22:19:17
UTC ·
(4 days ago)
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
Bad Web Bot
🇺🇸
justbible
2026-11-08 00:17:10
UTC ·
(5 days ago)
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 2 requests from 2026-11-08T00:17:10+00:00 to 2026-11-08T00:17:18+00:00, e.g. 'GET /en/kjv,bsb,asv/matt/10/10 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x ...
show more
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 2 requests from 2026-11-08T00:17:10+00:00 to 2026-11-08T00:17:18+00:00, e.g. 'GET /en/kjv,bsb,asv/matt/10/10 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested).
show less
Bad Web Bot
🇫🇷
masterguru
2026-11-06 11:57:56
UTC ·
(1 week ago)
Too much 404 requests in 1 minute. Operator GE matched 10 at IP:block_script. (46020-193)
Hacking
🇺🇸
TPI-Abuse
2026-11-06 09:38:10
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 91.254.3.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 04:38:04.522491 2026] [security2:error] [pid 17792:tid 17792] [client 91.254.3.160:46856] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 91.254.3.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 04:38:04.522491 2026] [security2:error] [pid 17792:tid 17792] [client 91.254.3.160:46856] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||smartradios.info|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "smartradios.info"] [uri "/wp-json/wp/v2/users"] [unique_id "au2f_GmKQFlnWuuboY_eKQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-06 08:06:08
UTC ·
(1 week ago)
WEB attack
Brute-Force
🇪🇸
pipeline.es
2026-11-06 04:19:42
UTC ·
(1 week ago)
WordPress login brute-force | URL: https://gacetadelturismo.com/xmlrpc.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-06T04:18:41Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\"91 ...
show more
WordPress login brute-force | URL: https://gacetadelturismo.com/xmlrpc.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-06T04:18:41Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\"91.254.3.160\",\"status_code\":503,\"url\":\"https://gacetadelturismo.com/xmlrpc.php\",\"user_agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15\",\"wfid\":475068 | ASN: Wind Tre S.p.A. | Country: IT
show less
Brute-Force
🇩🇪
georgengelmann
2026-11-05 22:36:33
UTC ·
(1 week ago)
Failed login attempt for admin
Brute-Force
Web App Attack
