🇺🇸
TPI-Abuse
2026-11-13 00:37:35
UTC ·
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 45.189.62.42 (42.62.189.45.ufinet.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:37:27.114969 2026] [security2:error] [pid 8587:tid 8587] [client ...
show more
(mod_security) mod_security (id:225170) triggered by 45.189.62.42 (42.62.189.45.ufinet.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:37:27.114969 2026] [security2:error] [pid 8587:tid 8587] [client 45.189.62.42:61011] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||appalachianfolkmagician.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "appalachianfolkmagician.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avZbxyicyvOpXVW3EeCtlAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇪
Jim Keir
2026-11-12 01:35:21
UTC ·
(2 days ago)
2026-11-12 01:35:21 45.189.62.42 File scanning, blocking 45.189.62.42 for 5 minutes
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 11:55:32
UTC ·
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 45.189.62.42 (42.62.189.45.ufinet.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 06:55:25.274029 2026] [security2:error] [pid 16668:tid 16668] [clien ...
show more
(mod_security) mod_security (id:225170) triggered by 45.189.62.42 (42.62.189.45.ufinet.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 06:55:25.274029 2026] [security2:error] [pid 16668:tid 16668] [client 45.189.62.42:13993] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||us.abecasis.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "us.abecasis.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au8RraTjkfv_1JIKKYWqcAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-11-07 04:27:32
UTC ·
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 02:59:16
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 45.189.62.42 (42.62.189.45.ufinet.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 21:59:11.583378 2026] [security2:error] [pid 3213351:tid 3213470] [c ...
show more
(mod_security) mod_security (id:225170) triggered by 45.189.62.42 (42.62.189.45.ufinet.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 21:59:11.583378 2026] [security2:error] [pid 3213351:tid 3213470] [client 45.189.62.42:61013] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ianajewellery.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ianajewellery.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au6T_9ESCeiz_2beNSQzVwAAAQY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 20:39:29
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 45.189.62.42 (42.62.189.45.ufinet.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 15:39:23.645488 2026] [security2:error] [pid 10760:tid 10760] [clien ...
show more
(mod_security) mod_security (id:225170) triggered by 45.189.62.42 (42.62.189.45.ufinet.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 15:39:23.645488 2026] [security2:error] [pid 10760:tid 10760] [client 45.189.62.42:61031] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hisfavorite.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hisfavorite.net"] [uri "/wp/wp-json/wp/v2/users"] [unique_id "au46-5TBRY4nEY2Hiy9pAAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
lp
2026-11-05 16:33:17
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 45.189.62.42
2026-11-05T17:12:13+0100 vpn Access-Reject station: 45.189.62.42
Brute-Force
Web App Attack
🇺🇸
lostswordfish.com
2026-11-05 00:46:04
UTC ·
(1 week ago)
Wordfence waf block on decarcerationnation
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 13:41:25
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 45.189.62.42 (42.62.189.45.ufinet.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 08:41:17.763342 2026] [security2:error] [pid 8950:tid 8950] [client ...
show more
(mod_security) mod_security (id:225170) triggered by 45.189.62.42 (42.62.189.45.ufinet.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 08:41:17.763342 2026] [security2:error] [pid 8950:tid 8950] [client 45.189.62.42:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cloudex.link|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cloudex.link"] [uri "/wp-json/wp/v2/users"] [unique_id "aus1_furA5-8ZmuumIbQagAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-04 01:18:49
UTC ·
(1 week ago)
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: metrics.astropot.space | Path: /xmlrpc.php | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple ...
show more
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: metrics.astropot.space | Path: /xmlrpc.php | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇨🇿
lp
2026-11-02 22:48:35
UTC ·
(1 week ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 45.189.62.42
2026-11-02T23:39:12+0100 vpn Access-Reject station: 45.189.62.42
Brute-Force
Web App Attack
🇺🇸
francelink.fr
2026-11-02 11:25:28
UTC ·
(1 week ago)
Azure WAF blocked a request. Rule: 100100. Observed at: 2026-11-02T11:23:44.000Z.
Web App Attack
2026-11-02 10:15:03
UTC ·
(1 week ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Attack Signature Blocked: /brands/shopby/manufacturer-nec-hp-axis-lsi-aruba_networks-sharp-haivision-xyz.html | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 | (Magento Site)
show less
Hacking
Bad Web Bot
🇨🇿
Countryman
2026-11-02 01:10:01
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇩🇰
ScamAware
2026-11-01 11:07:55
UTC ·
(1 week ago)
Detected by Cloudflare Security Events via WordPress automation. Detection: user_enumeration (WordPress user enumeration). Hits from same IP in last 60 minutes: 1. Unique request paths counted internally: 1. Cloudflare action: block. Cloudflare sourc ...
show more
Detected by Cloudflare Security Events via WordPress automation. Detection: user_enumeration (WordPress user enumeration). Hits from same IP in last 60 minutes: 1. Unique request paths counted internally: 1. Cloudflare action: block. Cloudflare source: firewallCustom.
show less
Brute-Force
Web App Attack
