🇺🇸
TPI-Abuse
2026-10-16 13:53:45
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:225170) triggered by 103.69.246.242 (reverse.anonet.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 09:53:38.379149 2026] [security2:error] [pid 10882:tid 10882] [client 103.6 ...
show more
(mod_security) mod_security (id:225170) triggered by 103.69.246.242 (reverse.anonet.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 09:53:38.379149 2026] [security2:error] [pid 10882:tid 10882] [client 103.69.246.242:63169] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||calvaryadminservices.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "calvaryadminservices.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atIsYsCWYq-cW9gHgfN1GQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-10-02 10:40:56
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-10-02 08:59:48
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-22 10:20:22
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
🇺🇸
鬼影233
2026-09-21 05:43:14
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
kosada.com
2026-08-26 13:56:56
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-18 11:59:33
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 103.69.246.242 (reverse.anonet.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 07:59:27.185392 2026] [security2:error] [pid 2363:tid 2363] [client 103.69. ...
show more
(mod_security) mod_security (id:240335) triggered by 103.69.246.242 (reverse.anonet.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 07:59:27.185392 2026] [security2:error] [pid 2363:tid 2363] [client 103.69.246.242:64478] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.69.246.242 (+1 hits since last alert)|roguetechink.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "roguetechink.com"] [uri "/xmlrpc.php"] [unique_id "aoRJH9AZuyZZW2Uh3MN_CwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-18 11:50:06
UTC ·
(2 months ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-18 08:50:24
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 103.69.246.242 (reverse.anonet.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 04:50:18.036538 2026] [security2:error] [pid 4685:tid 4685] [client 103.69. ...
show more
(mod_security) mod_security (id:240335) triggered by 103.69.246.242 (reverse.anonet.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 04:50:18.036538 2026] [security2:error] [pid 4685:tid 4685] [client 103.69.246.242:64488] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.69.246.242 (+1 hits since last alert)|magacine.tv|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "magacine.tv"] [uri "/xmlrpc.php"] [unique_id "aoQcytSIgfKCAA5cs2AQPAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-08-18 07:33:45
UTC ·
(2 months ago)
[TueAug1809:33:40.8307572026][security2:error][pid738768:tid738875][client103.69.246.242:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"9 ...
show more
[TueAug1809:33:40.8307572026][security2:error][pid738768:tid738875][client103.69.246.242:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"life-live.ch\"][uri\"/xmlrpc.php\"][unique_id\"aoQK1AO-g6B2xcWq3ROE6wAAAkQ\"]
show less
Port Scan
Brute-Force
Web App Attack
🇧🇪
madeit
2026-08-18 07:22:11
UTC ·
(2 months ago)
Web App Attack
🇩🇪
ghostwarriors
2026-08-18 07:20:20
UTC ·
(2 months ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-08-18 07:01:12
UTC ·
(2 months ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-08-18 06:56:21
UTC ·
(2 months ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
IN/India/reverse.anonet.in
Web App Attack
🇺🇸
TPI-Abuse
2026-08-18 06:01:34
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 103.69.246.242 (reverse.anonet.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 02:01:30.680123 2026] [security2:error] [pid 992:tid 992] [client 103.69.24 ...
show more
(mod_security) mod_security (id:240335) triggered by 103.69.246.242 (reverse.anonet.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 02:01:30.680123 2026] [security2:error] [pid 992:tid 992] [client 103.69.246.242:64446] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.69.246.242 (+1 hits since last alert)|wwtransform.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "wwtransform.org"] [uri "/xmlrpc.php"] [unique_id "aoP1OssfkWoQ9Vs8NI4bLAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
