🇺🇸
TPI-Abuse
2026-08-18 19:09:33
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 15:09:27.732742 2026] [security2:error] [pid 2470:tid 2470] [client 119.156.64.36:65435] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nextlevelcharge.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nextlevelcharge.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoSt5zPs_cVttGLc4rLGLAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-18 15:55:15
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 11:55:08.414828 2026] [security2:error] [pid 5758:tid 5758] [client 119.156.64.36:58433] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 119.156.64.36 (+1 hits since last alert)|dianamead.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "dianamead.com"] [uri "/xmlrpc.php"] [unique_id "aoSAXJtUDcpBsQIhfKjEMgAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-08-18 13:26:08
(3 days ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-18 09:54:07
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 05:54:00.687411 2026] [security2:error] [pid 5365:tid 5371] [client 119.156.64.36:57511] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 119.156.64.36 (+1 hits since last alert)|dbestcarting.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "dbestcarting.com"] [uri "/xmlrpc.php"] [unique_id "aoQruKCkycP7wdva3EFJXwAAAIA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
LTM
2026-08-18 06:20:02
(3 days ago)
WebServer - Attempts to exploit
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-17 16:55:21
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 12:55:17.867057 2026] [security2:error] [pid 19167:tid 19167] [client 119.156.64.36:50672] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 119.156.64.36 (+1 hits since last alert)|fadcometal.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "fadcometal.com"] [uri "/xmlrpc.php"] [unique_id "aoM89avsySMWBJrX0BmGhwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-16 19:14:54
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 15:14:48.095914 2026] [security2:error] [pid 5668:tid 5702] [client 119.156.64.36:53691] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 119.156.64.36 (+1 hits since last alert)|browbrew.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "browbrew.com"] [uri "/xmlrpc.php"] [unique_id "aoIMKL43-BqcKgjvPfXFiwAAAVU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-16 14:26:46
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 10:26:43.091149 2026] [security2:error] [pid 18626:tid 18626] [client 119.156.64.36:63605] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 119.156.64.36 (+1 hits since last alert)|xyncom.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "xyncom.com"] [uri "/xmlrpc.php"] [unique_id "aoHIo635YsVdsAdN7HOYQQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-08-15 18:06:52
(6 days ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇦🇺
screwlooseit.com.au
2026-08-15 10:04:22
(6 days ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
PK/Pakistan/-
Web App Attack
🇧🇪
madeit
2026-08-14 14:49:03
(1 week ago)
Web App Attack
🇺🇸
integrantservices.com
2026-08-14 12:57:05
(1 week ago)
(wordpress) Failed wordpress login from 119.156.64.36 (PK/Pakistan/-)
Brute-Force
🇩🇪
ghostwarriors
2026-08-14 12:50:35
(1 week ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
2026-08-14 12:25:00
(1 week ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-14 11:56:14
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 119.156.64.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 07:56:09.050145 2026] [security2:error] [pid 32459:tid 32459] [client 119.156.64.36:51285] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 119.156.64.36 (+1 hits since last alert)|williamfitzsimmons.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "williamfitzsimmons.com"] [uri "/xmlrpc.php"] [unique_id "an8CWd4F93kuFTDTUyuZ8AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack