🇩🇪
Vegascosmetics
2026-06-14 03:07:59
(6 days ago)
(Kingcopy.org-AI-IDS-Report):IP automatically blocked after PHP/webshell probe. Vegas Security
DDoS Attack
Hacking
Exploited Host
2026-06-14 02:05:44
(6 days ago)
Blocked: Reason='Suspicious traffic score=60 (review-based detection)'; Requests=15
Hacking
🇩🇪
LRob.fr
2026-06-14 01:45:02
(6 days ago)
Repeated 403 errors, blocked by Fail2ban in custom-403 jail
Bad Web Bot
🇳🇱
CryptoYakari
2026-06-14 01:35:23
(6 days ago)
182.54.236.194 - - [14/Jun/2026:04:35:20 +0300] "GET //wp-includes/ID3/license.txt HTTP/1.0" 404 351 ...
show more
182.54.236.194 - - [14/Jun/2026:04:35:20 +0300] "GET //wp-includes/ID3/license.txt HTTP/1.0" 404 3515 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
182.54.236.194 - - [14/Jun/2026:04:35:21 +0300] "GET //feed/ HTTP/1.0" 404 3515 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
182.54.236.194 - - [14/Jun/2026:04:35:21 +0300] "GET //xmlrpc.php?rsd HTTP/1.0" 404 531 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
182.54.236.194 - - [14/Jun/2026:04:35:21 +0300] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.0" 404 3515 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
182.54.236.194 - - [14/Jun/2026:04:35:22 +0300] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.0" 404 3515 "-" "Mozilla/5.0 (Windows NT 10.0
...
show less
Web Spam
Blog Spam
Web App Attack
Bad Web Bot
🇫🇷
Baking333
2026-06-14 01:13:21
(6 days ago)
[redacted] 182.54.236.194 - - [14/Jun/2026:02:13:19 +0100] "GET //wp-includes/ID3/[redacted] HTTP/1. ...
show more
[redacted] 182.54.236.194 - - [14/Jun/2026:02:13:19 +0100] "GET //wp-includes/ID3/[redacted] HTTP/1.1" 302 5333 0/34836 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" [redacted] 182.54.236.194 - - [14/Jun/2026:02:13:20 +0100] "GET /[redacted]?rsd HTTP/1.1" 302 1604 0/40247 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
show less
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-06-14 00:49:17
(6 days ago)
984 requests with url.path //xmlrpc.php
351 requests with url.path */wp-includes/wlwmanifest.xml
Brute-Force
Bad Web Bot
🇨🇦
Anytech
2026-06-13 23:31:55
(6 days ago)
Blocked by Conn-Monitor: Web scanning activity
Web App Attack
🇮🇱
spd.co.il
2026-06-11 18:01:36
(1 week ago)
Web application attack detected
Hacking
Web App Attack
🇫🇷
ardexter
2026-03-09 20:26:54
(3 months ago)
Wordpress attack and DDoSm
DDoS Attack
Web App Attack
2026-02-03 22:33:25
(4 months ago)
wordpress-trap
Web App Attack
🇺🇸
TPI-Abuse
2025-09-21 19:53:37
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 182.54.236.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 182.54.236.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 21 15:53:29.852756 2025] [security2:error] [pid 17990:tid 17990] [client 182.54.236.194:55882] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||scswat.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "scswat.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aNBXuZvbn5hXkcBH1UdqrwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-21 18:17:50
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 182.54.236.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 182.54.236.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 21 14:17:43.226082 2025] [security2:error] [pid 4760:tid 4760] [client 182.54.236.194:52859] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ralphharris.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ralphharris.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aNBBR6VYqp7KWSdHqumYRwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Packets-Decreaser.NET
2025-09-19 11:48:03
(9 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
2025-09-17 17:29:13
(9 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-09-17 16:50:53
(9 months ago)
(mod_security) mod_security (id:240335) triggered by 182.54.236.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 182.54.236.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 17 12:50:47.883275 2025] [security2:error] [pid 21037:tid 21037] [client 182.54.236.194:61637] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 182.54.236.194 (+1 hits since last alert)|nessmonsters.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nessmonsters.com"] [uri "/xmlrpc.php"] [unique_id "aMrm56BJbxrobDp8QOdAnQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack