🇺🇸
kosada.com
2026-07-28 14:12:02
(1 day ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-27 15:40:40
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 103.186.238.116 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 103.186.238.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 11:40:35.239507 2026] [security2:error] [pid 4021653:tid 4021653] [client 103.186.238.116:38174] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.barbaraehill.com|F|2"] [data ".barbaraehill.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.barbaraehill.com"] [uri "/blog/https:/www.barbaraehill.com"] [unique_id "amd78zunr_KUMhqnilcEcAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
bigorre.org
2026-07-18 06:33:03
(1 week ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
🇺🇸
kosada.com
2026-07-11 16:39:01
(2 weeks ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇮🇹
A000Z
2026-07-11 00:35:00
(2 weeks ago)
Fail2Ban: 103.186.238.116 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/ ...
show more
Fail2Ban: 103.186.238.116 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
show less
Bad Web Bot
🇺🇸
kosada.com
2026-06-29 07:11:13
(1 month ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇳🇿
FaB Property Group
2026-06-20 01:57:33
(1 month ago)
Requested file: tag/natural/
Web App Attack
🇺🇸
TPI-Abuse
2026-06-16 16:41:03
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 103.186.238.116 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 103.186.238.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 12:40:56.802339 2026] [security2:error] [pid 17303:tid 17303] [client 103.186.238.116:49525] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.186.238.116 (+1 hits since last alert)|walkercline.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "walkercline.com"] [uri "/xmlrpc.php"] [unique_id "ajF8mCATq2hFufQDjqwJuAAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-06-16 05:44:13
(1 month ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 16:55:17
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 103.186.238.116 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 103.186.238.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 12:55:11.501205 2026] [security2:error] [pid 6989:tid 7001] [client 103.186.238.116:61678] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.186.238.116 (+1 hits since last alert)|travelusa.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "travelusa.us"] [uri "/xmlrpc.php"] [unique_id "ajAubyeXNcrIRpOr7O9SBQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
ALPHANET
2026-06-12 12:55:03
(1 month ago)
Botnet or web spider not respecting robots.txt
DDoS Attack
Exploited Host
🇺🇸
nodepile
2026-06-08 17:33:05
(1 month ago)
Requests denied due to active blacklist hits (tenant=82 method=GET path=/media/catalog/product/cache ...
show more
Requests denied due to active blacklist hits (tenant=82 method=GET path=/media/catalog/product/cache/ddebc89b6d27929fece7153308b6a3fc/1/_/1_358_199.jpg ua='Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.9984.1107 Safari/537.36')
show less
Web App Attack
Exploited Host
🇩🇪
Vegascosmetics
2026-06-07 07:52:41
(1 month ago)
Kingcopy(AI-IDS) Report: IP automatically blocked after obfuscated encoding. Vegas Security System
DDoS Attack
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-05 17:12:37
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 103.186.238.116 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 103.186.238.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 13:12:30.469976 2026] [security2:error] [pid 21013:tid 21013] [client 103.186.238.116:64967] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.186.238.116 (+1 hits since last alert)|insidepublications.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "insidepublications.com"] [uri "/xmlrpc.php"] [unique_id "aiMDfv4q9IjgexRPlMuivgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-06-02 09:40:49
(1 month ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
-
Web App Attack