🇩🇪
ghostwarriors
2026-07-16 22:20:25
(1 day ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
rh24
2026-07-10 17:08:23
(1 week ago)
(xmlrpc_405) XMLRPC-Bot 405 102.216.238.6 (SL/Sierra Leone/-)
Hacking
🇫🇷
dynamix
2026-07-09 17:53:16
(1 week ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-08 22:31:10
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 102.216.238.6 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 102.216.238.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 18:31:02.118506 2026] [security2:error] [pid 30672:tid 30672] [client 102.216.238.6:58250] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 102.216.238.6 (+1 hits since last alert)|birdlovesfish.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "birdlovesfish.com"] [uri "/xmlrpc.php"] [unique_id "ak7PpiMBFxN--zjber9UcwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-07 11:19:11
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 102.216.238.6 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 102.216.238.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 07:19:03.469410 2026] [security2:error] [pid 1203:tid 1203] [client 102.216.238.6:63205] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 102.216.238.6 (+1 hits since last alert)|tigerpathteam.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tigerpathteam.org"] [uri "/xmlrpc.php"] [unique_id "akzgp9kTbN0cXB1cNgLqTAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
masterguru
2026-07-06 11:19:57
(1 week ago)
(xmlrpc) Failed xmlrpc access from 102.216.238.6 (SL/Sierra Leone/-): 5 in the last 3600 secs (0-122 ...
show more
(xmlrpc) Failed xmlrpc access from 102.216.238.6 (SL/Sierra Leone/-): 5 in the last 3600 secs (0-122)
show less
Hacking
2026-07-04 23:42:02
(1 week ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇺🇸
factor1
2026-07-04 14:23:42
(2 weeks ago)
Fail2ban at churndash Reports Abuse.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-30 17:13:56
(2 weeks ago)
(mod_security) mod_security (id:240335) triggered by 102.216.238.6 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 102.216.238.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 13:13:50.762710 2026] [security2:error] [pid 21841:tid 21841] [client 102.216.238.6:49779] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 102.216.238.6 (+1 hits since last alert)|daisydoesoap.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "daisydoesoap.com"] [uri "/xmlrpc.php"] [unique_id "akP5TpxHZ02G9t-F3VTCNwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
Progetto1
2026-06-23 22:52:02
(3 weeks ago)
Mail - Multiple failed login attempts
Brute-Force
Exploited Host
🇮🇹
VHosting
2026-06-22 11:26:33
(3 weeks ago)
Detected mail brute force attack from 4 different servers
Brute-Force
🇫🇷
dynamix
2026-06-19 20:05:45
(4 weeks ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇦🇺
screwlooseit.com.au
2026-06-13 16:38:29
(1 month ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
-
Web App Attack
🇫🇷
dynamix
2026-06-12 19:04:48
(1 month ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 11:42:14
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 102.216.238.6 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 102.216.238.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 07:42:08.923807 2026] [security2:error] [pid 2868:tid 2868] [client 102.216.238.6:60841] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 102.216.238.6 (+1 hits since last alert)|oogeothermal.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "oogeothermal.com"] [uri "/xmlrpc.php"] [unique_id "aivwkK_jsfYY3V4A6MGGAQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack