🇺🇸
TPI-Abuse
2025-09-26 22:49:24
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 92.223.85.69 (vpn-gw-prod-008.sin0-gcl.ff.avast ...
show more
(mod_security) mod_security (id:225170) triggered by 92.223.85.69 (vpn-gw-prod-008.sin0-gcl.ff.avast.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 26 18:49:20.334223 2025] [security2:error] [pid 16690:tid 16690] [client 92.223.85.69:5584] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||eddyandvanessa.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "eddyandvanessa.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aNcYcM7eIkRGoetItBld6AAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2025-08-04 00:20:21
(10 months ago)
11.451 requests with url.path */xmlrpc.php
192 requests with url.path */wp-includes/wlwmanifest.xm ...
show more
11.451 requests with url.path */xmlrpc.php
192 requests with url.path */wp-includes/wlwmanifest.xml
show less
Brute-Force
Bad Web Bot
🇦🇺
nzhost.co.nz
2025-08-03 23:31:52
(10 months ago)
$f2bV_matches
Hacking
Brute-Force
🇮🇹
VHosting
2025-08-03 21:25:48
(10 months ago)
Detected attack by Imunify360
Brute-Force
Web App Attack
2025-07-28 23:02:05
(10 months ago)
Ports: 25,2525,110,143,993,995; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-07-18 12:51:29
(10 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇮🇱
Dolphi
2025-06-23 17:40:05
(11 months ago)
POST //xmlrpc.php
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-06-16 03:43:32
(11 months ago)
(mod_security) mod_security (id:225170) triggered by 92.223.85.69 (vpn-gw-prod-008.sin0-gcl.ff.avast ...
show more
(mod_security) mod_security (id:225170) triggered by 92.223.85.69 (vpn-gw-prod-008.sin0-gcl.ff.avast.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 15 23:43:25.451200 2025] [security2:error] [pid 1081127:tid 1081127] [client 92.223.85.69:15227] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.edgebiopharma.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.edgebiopharma.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aE-S3fHkeFOdPIXkA2zqNAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-06-06 09:21:17
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇮🇩
penjaga BRIN
2025-06-06 06:24:31
(1 year ago)
Multiple web server 400 error codes from same source ip.-250
Web App Attack
🇮🇩
Burayot
2025-06-06 03:21:26
(1 year ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 92.223.85.69 (SG/Singapore/vpn-gw-p ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 92.223.85.69 (SG/Singapore/vpn-gw-prod-008.sin0-gcl.ff.avast.com): 1 in the last 3600 secs
show less
Web App Attack
🇹🇷
rtbh.com.tr
2025-04-30 20:06:22
(1 year ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇹🇷
rtbh.com.tr
2025-04-29 20:06:21
(1 year ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇪🇸
librebit
2025-04-29 00:30:09
(1 year ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2025-04-28 22:11:07
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 92.223.85.69 (vpn-gw-prod-008.sin0-gcl.ff.avast ...
show more
(mod_security) mod_security (id:210730) triggered by 92.223.85.69 (vpn-gw-prod-008.sin0-gcl.ff.avast.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 28 18:11:04.173798 2025] [security2:error] [pid 1156608:tid 1156608] [client 92.223.85.69:27270] [client 92.223.85.69] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.prostar.industries|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.prostar.industries"] [uri "/config/php.ini"] [unique_id "aA_8-HKCkLow52KRh30wDgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack