🇱🇻
garmtech.com
2026-06-27 03:36:59
(1 day ago)
IM360 WAF: Rate limit exceeded for XMLRPC DoS
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 11:59:12
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 123.231.93.159 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 123.231.93.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 07:59:08.010746 2026] [security2:error] [pid 31999:tid 31999] [client 123.231.93.159:53373] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 123.231.93.159 (+1 hits since last alert)|latentpixel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "latentpixel.com"] [uri "/xmlrpc.php"] [unique_id "aj5pjKva__bMeUZQJ9sawgAAACw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 06:52:33
(2 days ago)
(mod_security) mod_security (id:240335) triggered by 123.231.93.159 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 123.231.93.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 02:52:30.029056 2026] [security2:error] [pid 12734:tid 12734] [client 123.231.93.159:57126] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 123.231.93.159 (+1 hits since last alert)|gracebaptisthartsville.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "gracebaptisthartsville.com"] [uri "/xmlrpc.php"] [unique_id "aj4hrpx4IGKVl54vlXdJlgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-06-26 05:48:45
(2 days ago)
xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)
Hacking
🇪🇸
alferez
2026-06-25 12:01:22
(2 days ago)
xmlrpc.php attack DOS
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 10:11:26
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 123.231.93.159 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 123.231.93.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 06:11:22.734483 2026] [security2:error] [pid 17445:tid 17460] [client 123.231.93.159:55030] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 123.231.93.159 (+1 hits since last alert)|frannykingsmith.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "frannykingsmith.com"] [uri "/xmlrpc.php"] [unique_id "ajz-yguRZW9nGBExEwAfRgAAAMw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
pscriptos
2026-06-25 08:50:58
(3 days ago)
{"ClientAddr":"123.231.93.159:65197","ClientHost":"123.231.93.159","ClientPort":"65197","ClientUsern ...
show more
{"ClientAddr":"123.231.93.159:65197","ClientHost":"123.231.93.159","ClientPort":"65197","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":125639792,"OriginContentSize":418,"OriginDuration":117917458,"OriginStatus":403,"Overhead":7722334,"RequestAddr":"www.cleveradmin.de","RequestContentSize":712,"RequestCount":1393548,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-06-25T10:50:38.731034809+02:00","StartUTC":"2026-06-25T08:50:38.731034809Z","TLSCipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLSVersion":"1.2","entryPointName":"websecure","level":"info","msg":"","time":"2026-06-25T10:50:38+02:00"}
{"ClientAddr":"123.231.93.159:65197","ClientHost":"123.231.93.15
...
show less
Brute-Force
Web App Attack
🇺🇸
WeekendWeb
2026-06-25 05:05:12
(3 days ago)
Wordpress Vunerability attack
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 13:30:57
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 123.231.93.159 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 123.231.93.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 09:30:51.430591 2026] [security2:error] [pid 10844:tid 10844] [client 123.231.93.159:53120] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 123.231.93.159 (+1 hits since last alert)|rohanbyles.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rohanbyles.com.au"] [uri "/xmlrpc.php"] [unique_id "ajvcC8UxTjmLZYqb7sDd3QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 10:49:24
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 123.231.93.159 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 123.231.93.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 06:49:18.772220 2026] [security2:error] [pid 20706:tid 20706] [client 123.231.93.159:50620] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 123.231.93.159 (+1 hits since last alert)|ibermar.info|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ibermar.info"] [uri "/xmlrpc.php"] [unique_id "ajpkrmbLICjykbRsaCa6ZwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-06-23 10:44:21
(5 days ago)
xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)
Hacking