🇲🇾
Rizzy
2026-06-26 19:33:23
(1 day ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 16:32:02
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): ...
show more
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 12:31:55.210128 2026] [security2:error] [pid 13472:tid 13472] [client 136.158.41.92:6682] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 136.158.41.92 (+1 hits since last alert)|feministvoice.blog|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "feministvoice.blog"] [uri "/xmlrpc.php"] [unique_id "aj6pe_wlTe1RK_aQjaWe_wAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-26 12:58:42
(1 day ago)
[redacted] 136.158.41.92 - - [26/Jun/2026:14:57:57 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "W ...
show more
[redacted] 136.158.41.92 - - [26/Jun/2026:14:57:57 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 136.158.41.92 - - [26/Jun/2026:14:58:06 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 136.158.41.92 - - [26/Jun/2026:14:58:16 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 136.158.41.92 - - [26/Jun/2026:14:58:27 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 136.158.41.92 - - [26/Jun/2026:14:58:38 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2)"
...
show less
Hacking
Web App Attack
🇫🇷
dynamix
2026-06-26 09:41:02
(1 day ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇫🇷
masterguru
2026-06-25 02:02:41
(3 days ago)
xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)
Hacking
🇺🇸
cwytech
2026-06-24 16:16:55
(3 days ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-xmlrpc-bf-high.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 13:29:33
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): ...
show more
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 09:29:23.336489 2026] [security2:error] [pid 3508:tid 3508] [client 136.158.41.92:32313] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 136.158.41.92 (+1 hits since last alert)|sooperare.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "sooperare.com"] [uri "/xmlrpc.php"] [unique_id "ajvbs2eowvIc8cLm-LPBggAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 12:20:07
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): ...
show more
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 08:19:59.784156 2026] [security2:error] [pid 18669:tid 18669] [client 136.158.41.92:50940] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 136.158.41.92 (+1 hits since last alert)|fernfield.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "fernfield.com"] [uri "/xmlrpc.php"] [unique_id "ajvLb156c4xPAcduxSXQ3QAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Lunix
2026-06-24 11:46:56
(3 days ago)
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-06-23 23:36:06
(4 days ago)
4.178 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-23 23:24:12
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): ...
show more
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 19:24:08.916032 2026] [security2:error] [pid 1131:tid 1131] [client 136.158.41.92:11311] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 136.158.41.92 (+1 hits since last alert)|bigholegolf.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "bigholegolf.com"] [uri "/xmlrpc.php"] [unique_id "ajsVmKTX9-D_qkmzRmLaUgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 19:49:38
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): ...
show more
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 15:49:34.974384 2026] [security2:error] [pid 30404:tid 30404] [client 136.158.41.92:15177] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 136.158.41.92 (+1 hits since last alert)|automatebi.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "automatebi.com"] [uri "/xmlrpc.php"] [unique_id "ajrjTig3h10xoS9Vxx8_LgAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 17:14:54
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): ...
show more
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 13:14:49.280288 2026] [security2:error] [pid 23986:tid 23986] [client 136.158.41.92:55741] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 136.158.41.92 (+1 hits since last alert)|protection4allsecurity.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "protection4allsecurity.com"] [uri "/xmlrpc.php"] [unique_id "ajq_CQy5G--etx7LNxhmNAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-23 16:42:08
(4 days ago)
[redacted] 136.158.41.92 - - [23/Jun/2026:18:41:25 +0200] "POST /xmlrpc.php HTTP/1.1" 403 1511 "-" " ...
show more
[redacted] 136.158.41.92 - - [23/Jun/2026:18:41:25 +0200] "POST /xmlrpc.php HTTP/1.1" 403 1511 "-" "Jetpack/12.0; WordPress/6.3; http://site93445067.com"
[redacted] 136.158.41.92 - - [23/Jun/2026:18:41:36 +0200] "POST /xmlrpc.php HTTP/1.1" 403 0 "-" "Jetpack by WordPress.com"
[redacted] 136.158.41.92 - - [23/Jun/2026:18:41:46 +0200] "POST /xmlrpc.php HTTP/1.1" 403 0 "-" "Jetpack/12.1; WordPress/6.1; http://site92154510.com"
[redacted] 136.158.41.92 - - [23/Jun/2026:18:41:57 +0200] "POST /xmlrpc.php HTTP/1.1" 403 0 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.2)"
[redacted] 136.158.41.92 - - [23/Jun/2026:18:42:08 +0200] "POST /xmlrpc.php HTTP/1.1" 403 0 "-" "Jetpack by WordPress.com"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 09:55:52
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): ...
show more
(mod_security) mod_security (id:240335) triggered by 136.158.41.92 (92.41.158.136.convergeict.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 05:55:48.626215 2026] [security2:error] [pid 31670:tid 31670] [client 136.158.41.92:15303] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 136.158.41.92 (+1 hits since last alert)|hvacmechanalysis.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "hvacmechanalysis.com"] [uri "/xmlrpc.php"] [unique_id "ajpYJNGDn0yVjP8Dna_eSQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack