🇧🇪
cmbplf
2026-08-01 00:39:05
(3 days ago)
86 requests with url.path //xmlrpc.php
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-16 15:40:55
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 159.26.120.57 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 159.26.120.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 11:40:51.858311 2026] [security2:error] [pid 7059:tid 7059] [client 159.26.120.57:33752] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.mosheimlib.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.mosheimlib.org"] [uri "/wp-json/wp/v2/users/"] [unique_id "alj7g6YFeETP9UkLM5IQ3wAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
vincent_EUDIER
2026-07-16 14:20:01
(2 weeks ago)
SURICATA HTTP unable to match response to request
Hacking
🇺🇸
TPI-Abuse
2026-07-16 13:16:17
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 159.26.120.57 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 159.26.120.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 09:16:11.978759 2026] [security2:error] [pid 849:tid 849] [client 159.26.120.57:64748] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.montidaunitour.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.montidaunitour.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aljZm5daGdQDcmPQLFjx9AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-16 12:20:18
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 159.26.120.57 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 159.26.120.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 08:20:14.579957 2026] [security2:error] [pid 16339:tid 16339] [client 159.26.120.57:32458] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||monmouthcountydanceclasses.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "monmouthcountydanceclasses.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aljMflduEqS7HtsHZVe1egAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-16 12:11:58
(2 weeks ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇳🇱
BlueWire Hosting
2026-07-16 11:49:36
(2 weeks ago)
Probing websites for vulnerabilities
Web App Attack
2026-07-16 11:33:23
(2 weeks ago)
[redacted] 159.26.120.57 - - [16/Jul/2026:13:33:17 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" " ...
show more
[redacted] 159.26.120.57 - - [16/Jul/2026:13:33:17 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 159.26.120.57 - - [16/Jul/2026:13:33:18 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 159.26.120.57 - - [16/Jul/2026:13:33:19 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 159.26.120.57 - - [16/Jul/2026:13:33:19 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 159.26.120.57 - - [16/Jul/2026:13:33:20 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla
...
show less
Hacking
Web App Attack
🇺🇸
mnsf
2026-07-16 11:05:04
(2 weeks ago)
Abuse Detected (20)
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-07-16 09:59:14
(2 weeks ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-16 09:15:10
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 159.26.120.57 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 159.26.120.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 05:15:04.301934 2026] [security2:error] [pid 20062:tid 20062] [client 159.26.120.57:60183] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||modestosoftwater.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "modestosoftwater.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "alihGIiQB3qtwsngkYinIgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-16 08:30:50
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 159.26.120.57 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 159.26.120.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 04:30:44.095647 2026] [security2:error] [pid 6721:tid 6721] [client 159.26.120.57:14401] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.modalguitarist.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.modalguitarist.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aliWtIHpqzwX4Bi2ojTXogAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-07-16 08:01:18
(2 weeks ago)
16.738 requests in 1 hour (1w21h59m)
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-16 07:53:06
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 159.26.120.57 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 159.26.120.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 03:53:00.361367 2026] [security2:error] [pid 1673:tid 1673] [client 159.26.120.57:42811] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||mobileonlinecasinos.co|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mobileonlinecasinos.co"] [uri "/wp-json/wp/v2/users/"] [unique_id "aliN3DQSi66YLMbHa_9hwAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
bigwavedave
2026-07-16 07:52:40
(2 weeks ago)
Wordpress Attack
Web App Attack