🇫🇷
dynamix
2026-06-28 15:52:28
(3 hours ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
cwytech
2026-06-26 04:35:36
(2 days ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.
Bad Web Bot
Web App Attack
🇺🇸
TAY
2026-06-17 04:11:07
(1 week ago)
103.111.225.90 - - [17/Jun/2026:12:10:15 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5893 "-" "Jetpack by ...
show more
103.111.225.90 - - [17/Jun/2026:12:10:15 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5893 "-" "Jetpack by WordPress.com"
103.111.225.90 - - [17/Jun/2026:12:10:56 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5893 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.1)"
103.111.225.90 - - [17/Jun/2026:12:11:06 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5893 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.4)"
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-06-17 03:41:48
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 103.111.225.90 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.111.225.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 23:41:42.210845 2026] [security2:error] [pid 15739:tid 15739] [client 103.111.225.90:4385] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.111.225.90 (+1 hits since last alert)|pharmaceuticalsalescertifications.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pharmaceuticalsalescertifications.com"] [uri "/xmlrpc.php"] [unique_id "ajIXdt0v1OPufSa-DD9KdAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2026-06-16 03:42:12
(1 week ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-06-12 08:53:45
(2 weeks ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇦🇺
MAGIC
2026-06-01 01:20:16
(3 weeks ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇩🇪
milcraft.nl
2026-05-18 02:08:51
(1 month ago)
Suspicious WooCommerce query combination detected. Not default available on websites. Matched combi ...
show more
Suspicious WooCommerce query combination detected. Not default available on websites. Matched combi patterns: filter_, add-to-cart=, orderby=, product_count=. Activity is consistent with high-volume request abuse.
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-05-13 09:08:55
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 103.111.225.90 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 103.111.225.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 05:08:49.580027 2026] [security2:error] [pid 26786:tid 26786] [client 103.111.225.90:49358] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||borzois.com|F|2"] [data ".batw.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "borzois.com"] [uri "/www.BATW.com"] [unique_id "agQ_oeKoM_3bwe_IG5DhAQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-04-29 13:34:38
(1 month ago)
Unauthorized connection attempt on Port 23
Port Scan
Hacking
Exploited Host
2026-04-29 10:06:13
(1 month ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
🇺🇸
kosada.com
2026-04-21 09:26:19
(2 months ago)
Web bot: DDoS
DDoS Attack
Bad Web Bot
🇺🇸
stechusa
2026-04-12 03:56:23
(2 months ago)
[Askari] | Behavior: Outdated browser, Concurrent page load during attack, HTTP/1.1 over TLS, Holdin ...
show more
[Askari] | Behavior: Outdated browser, Concurrent page load during attack, HTTP/1.1 over TLS, Holding server worker, Targeting specific pages
show less
Bad Web Bot
DDoS Attack
🇺🇸
stechusa
2026-04-12 03:56:23
(2 months ago)
ELEVATED_THREAT | 12 IPs targeting /category/light-bulbs.html | HTTP/1.1 over TLS (elevated=True) | ...
show more
ELEVATED_THREAT | 12 IPs targeting /category/light-bulbs.html | HTTP/1.1 over TLS (elevated=True) | Facet request during elevated threat (facet_ratio=0.47, unique_ips=136)
show less
Bad Web Bot
DDoS Attack
🇩🇪
pressler.pro
2025-09-21 08:23:15
(9 months ago)
Fail2ban - DDoS attack on woocommerce shop
...
DDoS Attack