🇩🇪
FeG Deutschland
2026-09-23 16:24:56
(1 minute ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 03:03:28
(13 hours ago)
(mod_security) mod_security (id:225170) triggered by 93.108.134.68 (68.134.108.93.rev.vodafone.pt): ...
show more
(mod_security) mod_security (id:225170) triggered by 93.108.134.68 (68.134.108.93.rev.vodafone.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 23:03:22.510104 2026] [security2:error] [pid 22622:tid 22622] [client 93.108.134.68:45792] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||vespaitaliancafe.matteozacchino.dev|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "vespaitaliancafe.matteozacchino.dev"] [uri "/wp-json/wp/v2/users/me"] [unique_id "arNBejRzUQkMBp9HNZYkPAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-09-23 02:25:37
(14 hours ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-login-lockdown-high.
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-09-22 12:02:34
(1 day ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇬🇧
gigatech
2026-09-22 11:05:04
(1 day ago)
Webserver Probing
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 01:54:00
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 93.108.134.68 (68.134.108.93.rev.vodafone.pt): ...
show more
(mod_security) mod_security (id:225170) triggered by 93.108.134.68 (68.134.108.93.rev.vodafone.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 21:53:52.230275 2026] [security2:error] [pid 19056:tid 19056] [client 93.108.134.68:37618] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.store.newmooncafe.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.store.newmooncafe.com"] [uri "/wp-json/wp/v2/users"] [unique_id "arHfsPiHZGCBmvjnpSoQ9AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 21:56:15
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 93.108.134.68 (68.134.108.93.rev.vodafone.pt): ...
show more
(mod_security) mod_security (id:225170) triggered by 93.108.134.68 (68.134.108.93.rev.vodafone.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 17:56:07.863611 2026] [security2:error] [pid 19348:tid 19348] [client 93.108.134.68:59070] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mail.tonispray.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mail.tonispray.com"] [uri "/wp-json/wp/v2/users"] [unique_id "arGn95VhVzf7PyxXPJ3RnQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-21 04:06:03
(2 days ago)
WordPress login brute-force | path: /wp-fi/wp-login.php | 2026-09-21 04:06 UTC
Brute-Force
Web App Attack
🇩🇪
FeG Deutschland
2026-09-21 01:26:11
(2 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇩🇪
LRob
2026-09-20 02:40:38
(3 days ago)
Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ...
show more
Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for | method: GET | path: /wp-login.php | 2026-09-20 02:40 UTC
show less
Bad Web Bot
🇩🇪
FeG Deutschland
2026-09-19 19:05:50
(3 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇩🇪
LRob
2026-09-18 15:02:34
(5 days ago)
Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ...
show more
Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for | method: GET | path: /wp-login.php | 2026-09-18 15:02 UTC
show less
Bad Web Bot
2026-09-09 07:34:36
(2 weeks ago)
denied traffic to a non-approved destination port. destination port 20471.
Port Scan
🇺🇸
TPI-Abuse
2026-09-08 10:19:00
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 93.108.134.68 (68.134.108.93.rev.vodafone.pt): ...
show more
(mod_security) mod_security (id:225170) triggered by 93.108.134.68 (68.134.108.93.rev.vodafone.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 06:18:54.104320 2026] [security2:error] [pid 22078:tid 22078] [client 93.108.134.68:35700] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||americanexportimport.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "americanexportimport.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ap_hDiF9KYvEdc9nG61TuwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
ELYAZ
2026-09-08 10:02:59
(2 weeks ago)
(wordpress) Failed wordpress login from 93.108.134.68 (PT/Portugal/68.134.108.93.rev.vodafone.pt): ...
show more
(wordpress) Failed wordpress login from 93.108.134.68 (PT/Portugal/68.134.108.93.rev.vodafone.pt): (CF_ENABLE)
show less
Brute-Force