🇩🇪
ghostwarriors
2026-08-22 08:20:16
UTC ·
(2 months ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-08-22 07:55:26
UTC ·
(2 months ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-21 12:12:04
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 08:11:55.813544 2026] [security2:error] [pid 24583:tid 24623] [client 103.160.26.158:64179] ...
show more
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 08:11:55.813544 2026] [security2:error] [pid 24583:tid 24623] [client 103.160.26.158:64179] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.160.26.158 (+1 hits since last alert)|frannykingsmith.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "frannykingsmith.com"] [uri "/xmlrpc.php"] [unique_id "aohAi4syI90i6bF3QvS3_AAAAdg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-21 11:43:07
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 07:43:02.412992 2026] [security2:error] [pid 12454:tid 12454] [client 103.160.26.158:58992] ...
show more
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 07:43:02.412992 2026] [security2:error] [pid 12454:tid 12454] [client 103.160.26.158:58992] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.160.26.158 (+1 hits since last alert)|qed-consulting.co|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "qed-consulting.co"] [uri "/xmlrpc.php"] [unique_id "aog5xqqLFmbYbqlQf6IzWAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-21 11:10:31
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 07:10:25.346180 2026] [security2:error] [pid 16472:tid 16472] [client 103.160.26.158:49303] ...
show more
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 07:10:25.346180 2026] [security2:error] [pid 16472:tid 16472] [client 103.160.26.158:49303] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.160.26.158 (+1 hits since last alert)|nolaanime.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nolaanime.com"] [uri "/xmlrpc.php"] [unique_id "aogyIVweedKvmD0o2YJdnwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-08-21 09:06:19
UTC ·
(2 months ago)
WordPress login brute-force | path: /xmlrpc.php
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-21 08:07:06
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 04:07:00.564389 2026] [security2:error] [pid 5562:tid 5562] [client 103.160.26.158:52119] M ...
show more
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 04:07:00.564389 2026] [security2:error] [pid 5562:tid 5562] [client 103.160.26.158:52119] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.160.26.158 (+1 hits since last alert)|modestosoftwater.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "modestosoftwater.com"] [uri "/xmlrpc.php"] [unique_id "aogHJIh3OjYp1whK4sCUsAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-08-21 07:33:38
UTC ·
(2 months ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇳🇿
Tripwire
2026-08-21 07:29:12
UTC ·
(2 months ago)
Probing for Wordpress - /xmlrpc.php
Brute-Force
Web App Attack
🇺🇸
integrantservices.com
2026-08-20 10:28:45
UTC ·
(2 months ago)
(wordpress) Failed wordpress login from 103.160.26.158 (IN/India/-)
Brute-Force
🇺🇸
lostswordfish.com
2026-08-20 09:16:04
UTC ·
(2 months ago)
Wordfence waf block on pameganslaw
Web App Attack
🇺🇸
TPI-Abuse
2026-08-20 06:24:11
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 02:24:03.576854 2026] [security2:error] [pid 333:tid 333] [client 103.160.26.158:63896] Mod ...
show more
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 02:24:03.576854 2026] [security2:error] [pid 333:tid 333] [client 103.160.26.158:63896] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.160.26.158 (+1 hits since last alert)|harvestfrc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "harvestfrc.com"] [uri "/xmlrpc.php"] [unique_id "aoadgwwZTU_4e9G8u3s-SQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-19 13:15:17
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 19 09:15:09.381935 2026] [security2:error] [pid 6279:tid 6279] [client 103.160.26.158:52881] M ...
show more
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 19 09:15:09.381935 2026] [security2:error] [pid 6279:tid 6279] [client 103.160.26.158:52881] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.160.26.158 (+1 hits since last alert)|artspacecleveland.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "artspacecleveland.org"] [uri "/xmlrpc.php"] [unique_id "aoWsXVHKEY4wva4xkt0wjAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-19 12:42:00
UTC ·
(2 months ago)
(wordpress) Failed wordpress login from 103.160.26.158 (IN/India/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-06-03 13:26:20
UTC ·
(5 months ago)
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 09:26:16.251669 2026] [security2:error] [pid 27413:tid 27413] [client 103.160.26.158:55928] ...
show more
(mod_security) mod_security (id:240335) triggered by 103.160.26.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 09:26:16.251669 2026] [security2:error] [pid 27413:tid 27413] [client 103.160.26.158:55928] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.160.26.158 (+1 hits since last alert)|zerotaxlab.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "zerotaxlab.com"] [uri "/xmlrpc.php"] [unique_id "aiAreBztmE82Zw_dlbqncgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack