🇫🇷
tecnicorioja
2026-11-11 23:01:24
UTC ·
(3 days ago)
wp-login attack [11/Nov/2026:11:50:39
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 01:03:35
UTC ·
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 94.41.140.23 (94.41.140.23.dynamic.o56.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:03:28.886700 2026] [security2:error] [pid 16440:tid 16440] [clie ...
show more
(mod_security) mod_security (id:225170) triggered by 94.41.140.23 (94.41.140.23.dynamic.o56.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 20:03:28.886700 2026] [security2:error] [pid 16440:tid 16440] [client 94.41.140.23:44568] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||totaleventsandtents.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "totaleventsandtents.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avO-4CFRGZeohQoapWijUgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-10 23:00:17
UTC ·
(4 days ago)
| [Dangerous/Russia] Aggressive IP 94.41.140.23 (~30 hits). Type: DoS Defender- Web server 400 error code
Web App Attack
Hacking
SQL Injection
🇩🇪
ghostwarriors
2026-11-10 15:20:39
UTC ·
(5 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-10 15:04:16
UTC ·
(5 days ago)
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0 ...
show more
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Sa
Requested, e.g.:
- login.[REDACTED]/wp-admin/
show less
Web App Attack
2026-11-09 16:17:03
UTC ·
(6 days ago)
Bot / scanning and/or hacking attempts: [1/1] done, POST /wp-login.php HTTP/2.0
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 19:44:04
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 94.41.140.23 (94.41.140.23.dynamic.o56.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 14:44:00.561127 2026] [security2:error] [pid 9854:tid 9854] [client ...
show more
(mod_security) mod_security (id:225170) triggered by 94.41.140.23 (94.41.140.23.dynamic.o56.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 14:44:00.561127 2026] [security2:error] [pid 9854:tid 9854] [client 94.41.140.23:44737] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||arogun.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "arogun.org"] [uri "/wp-json/wp/v2/users"] [unique_id "au4uAOWPoY1bNdbUYY_ctAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-11-05 01:10:01
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
lostswordfish.com
2026-11-04 23:46:03
UTC ·
(1 week ago)
Wordfence waf block on parsol
Web App Attack
🇫🇷
LRob
2026-11-04 22:18:29
UTC ·
(1 week ago)
Not following 301 redirects — wasted requests | method: POST | path: /wp-login.php | ua: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Mobile Safari/537.36
Bad Web Bot
🇪🇸
pipeline.es
2026-11-04 18:37:22
UTC ·
(1 week ago)
WordPress login brute-force | URL: https://gacetadelturismo.com/wp-login.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-04T18:35:40Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\" ...
show more
WordPress login brute-force | URL: https://gacetadelturismo.com/wp-login.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-11-04T18:35:40Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\"94.41.140.23\",\"status_code\":503,\"url\":\"https://gacetadelturismo.com/wp-login.php\",\"user_agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:148.0) Gecko/20100101 Firefox/148.0\",\"wfid\":4745830} | ASN: JSC Ufanet | Country: RU
show less
Brute-Force
🇩🇪
LRob
2026-11-04 14:48:01
UTC ·
(1 week ago)
Web exploit attempt | method: GET | path: / | query: author=1&feed=rss2, author=2&feed=rss2 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Hacking
Web App Attack
