🇺🇸
lostswordfish.com
2026-06-24 20:44:03
(4 days ago)
Wordfence waf block on taussigtravel
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 19:31:02
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 117.221.168.119 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 117.221.168.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 15:30:48.568981 2026] [security2:error] [pid 17870:tid 17870] [client 117.221.168.119:63307] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 117.221.168.119 (+1 hits since last alert)|ohwaitiforgot.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ohwaitiforgot.com"] [uri "/xmlrpc.php"] [unique_id "ajwwaA3Bt2laqDJaj13XVAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-24 18:58:02
(4 days ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
2026-06-24 11:59:15
(5 days ago)
(wordpress) Failed wordpress login from 117.221.168.119 (IN/India/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-06-24 11:30:59
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 117.221.168.119 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 117.221.168.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 07:30:46.445007 2026] [security2:error] [pid 15687:tid 15687] [client 117.221.168.119:56205] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 117.221.168.119 (+1 hits since last alert)|kbalan.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kbalan.com"] [uri "/xmlrpc.php"] [unique_id "aju_5qWKTr7nBSc8ZU-rmQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-24 08:56:05
(5 days ago)
[ns41.kdns.gr] httpd-xmlrpc-post: sites=medisto.gr; logs=/var/log/httpd/domains/medisto.gr.log; samp ...
show more
[ns41.kdns.gr] httpd-xmlrpc-post: sites=medisto.gr; logs=/var/log/httpd/domains/medisto.gr.log; samples=/xmlrpc.php
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 06:54:37
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 117.221.168.119 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 117.221.168.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 02:54:26.647064 2026] [security2:error] [pid 9564:tid 9583] [client 117.221.168.119:58705] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 117.221.168.119 (+1 hits since last alert)|theyogicat.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "theyogicat.com"] [uri "/xmlrpc.php"] [unique_id "ajt_IjLRHY-N3zmMbDaHxgAAANE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-24 05:36:33
(5 days ago)
Blocked by ModSec and CSF
Port Scan
🇺🇸
TPI-Abuse
2026-06-24 05:21:18
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 117.221.168.119 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 117.221.168.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 01:21:09.184533 2026] [security2:error] [pid 19524:tid 19524] [client 117.221.168.119:59624] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 117.221.168.119 (+1 hits since last alert)|nordicbuilders.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nordicbuilders.net"] [uri "/xmlrpc.php"] [unique_id "ajtpRUzzdbMT39Kujhtf3wAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
debestelapp
2026-06-24 02:05:05
(5 days ago)
Web App Attack
🇧🇪
cmbplf
2026-06-24 01:30:48
(5 days ago)
3.341 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-24 01:17:12
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 117.221.168.119 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 117.221.168.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 21:17:00.701962 2026] [security2:error] [pid 13232:tid 13232] [client 117.221.168.119:63371] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 117.221.168.119 (+1 hits since last alert)|doreenkimura.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "doreenkimura.com"] [uri "/xmlrpc.php"] [unique_id "ajswDA2yux_72QD6s9t-QQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
netclix.gr
2026-06-23 23:09:37
(5 days ago)
(wordpress) Failed wordpress login from 117.221.168.119 (IN/India/-): (CF_ENABLE)
Brute-Force
🇫🇷
masterguru
2026-06-23 21:37:43
(5 days ago)
xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)
Hacking
🇺🇸
MPL
2025-06-23 09:24:58
(1 year ago)
tcp/23 (2 or more attempts)
Port Scan