🇧🇪
cmbplf
2026-11-07 22:00:49
UTC ·
(20 hours ago)
5.331 4xx requests in 1 hour (1w6d23h)
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-06 04:33:34
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 74.7.227.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 23:33:29.539466 2026] [security2:error] [pid 21592:tid 21592] [client 74.7.227.37:41688] ModSe ...
show more
(mod_security) mod_security (id:225170) triggered by 74.7.227.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 23:33:29.539466 2026] [security2:error] [pid 21592:tid 21592] [client 74.7.227.37:41688] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||omahops.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "omahops.org"] [uri "/wp-json/wp/v2/users/3"] [unique_id "au1YmRnEdyJA_mpzqthEhwAAAAw"], referer: https://omahops.org/author/kent/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 00:32:14
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 74.7.227.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 19:32:08.431837 2026] [security2:error] [pid 3930356:tid 3930373] [client 74.7.227.37:35906] M ...
show more
(mod_security) mod_security (id:210492) triggered by 74.7.227.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 19:32:08.431837 2026] [security2:error] [pid 3930356:tid 3930373] [client 74.7.227.37:35906] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.danelandia.com"] [uri "/wp-config.php"] [unique_id "au0gCCX4sgzUOHhHHvDZIAAAAA8"], referer: https://danelandia.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 11:47:34
UTC ·
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 74.7.227.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 07:47:28.997027 2026] [security2:error] [pid 4197:tid 4197] [client 74.7.227.37:47292] ModSecu ...
show more
(mod_security) mod_security (id:225170) triggered by 74.7.227.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 07:47:28.997027 2026] [security2:error] [pid 4197:tid 4197] [client 74.7.227.37:47292] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||schwanpaint.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "schwanpaint.com"] [uri "/wp-json/wp/v2/users/3"] [unique_id "auSD0EsgVvNk3QNhPoCZZAAAAAg"], referer: https://schwanpaint.com/author/lallster/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
aranguren.org
2026-10-29 10:25:11
UTC ·
(1 week ago)
74.7.227.37 - - [29/Oct/2026:21:25:01 +1100] "GET /aranguren.org/pi.hole.aranguren.org/..%2F../static/definitions.html HTTP/2.0" 404 1248 "https://munin.aranguren.org/aranguren.org/pi.hole.aranguren.org/pihole_querytypes.html" "Mozilla/5.0 AppleWebKi ...
show more
74.7.227.37 - - [29/Oct/2026:21:25:01 +1100] "GET /aranguren.org/pi.hole.aranguren.org/..%2F../static/definitions.html HTTP/2.0" 404 1248 "https://munin.aranguren.org/aranguren.org/pi.hole.aranguren.org/pihole_querytypes.html" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" TLSv1.3 TLS_AES_256_GCM_SHA384
74.7.227.37 - - [29/Oct/2026:21:25:10 +1100] "GET /aranguren.org/frigate.aranguren.org/diskstats_throughput/..%2F..%2F../static/definitions.html HTTP/2.0" 404 1268 "https://munin.aranguren.org/aranguren.org/frigate.aranguren.org/diskstats_throughput/loop11.html" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" TLSv1.3 TLS_AES_256_GCM_SHA384
74.7.227.37 - - [29/Oct/2026:21:25:10 +1100] "GET /aranguren.org/frigate.aranguren.org/diskstats_iops/..%2F..%2F../static/definitions.html HTTP/2.0" 404 1256 "https://munin.aranguren.org/aranguren.org/frigate.aranguren.org/diskstats_iops/
...
show less
Bad Web Bot
🇯🇵
VXG-NET
2026-10-26 22:05:55
UTC ·
(1 week ago)
port=443, indicator_type=code-execution
Hacking
🇳🇱
Site.eu
2026-10-22 02:36:43
UTC ·
(2 weeks ago)
Excessive multi-domain requests
Brute-Force
🇳🇱
Site.eu
2026-10-21 00:32:10
UTC ·
(2 weeks ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
LRob
2026-10-20 02:22:29
UTC ·
(2 weeks ago)
Crawler ignoring refusals | ua: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot) | path: /xmlrpc.php
Bad Web Bot
🇩🇪
palzer.IT
2026-10-15 04:50:14
UTC ·
(3 weeks ago)
Fail2ban automatic report for plesk-apache-badbot: 74.7.227.37 - - [05/Oct/2026:00:08:15 +0200] GET / [DOMAIN_REMOVED] 302 6589 [DOMAIN_REMOVED] Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +[DOMAIN_REMOVED]
Bad Web Bot
2026-10-13 20:42:06
UTC ·
(3 weeks ago)
IP matched detection query Detection of too many failed responses.
Brute-Force
Bad Web Bot
Hacking
🇧🇪
cmbplf
2026-10-13 08:12:55
UTC ·
(3 weeks ago)
27.048 requests in 1 hour (1w6d22h)
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-10 06:22:48
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210730) triggered by 74.7.227.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 02:22:41.541230 2026] [security2:error] [pid 2023:tid 2023] [client 74.7.227.37:34500] ModSecu ...
show more
(mod_security) mod_security (id:210730) triggered by 74.7.227.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 02:22:41.541230 2026] [security2:error] [pid 2023:tid 2023] [client 74.7.227.37:34500] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.tecnoconce.tecnoconce.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.tecnoconce.tecnoconce.com"] [uri "/p-php.ini"] [unique_id "asnZsT9x3d87gw-wod6YggAAAB8"], referer: https://www.tecnoconce.tecnoconce.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-10-09 08:41:56
UTC ·
(4 weeks ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 74.7.227.37 (US/United States/-): 1 in the last 3600 secs (0-195)
Hacking
🇸🇪
vaia.cloud
2026-10-08 02:20:01
UTC ·
(1 month ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
