🇺🇸
kosada.com
2026-08-01 04:15:27
(1 day ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
2026-07-29 07:00:00
(4 days ago)
Apache probe; attempts=230; exact paths: /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-07-25 09:00:10
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 140.213.190.205 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 140.213.190.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 05:00:04.575616 2026] [security2:error] [pid 743474:tid 743474] [client 140.213.190.205:13261] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 140.213.190.205 (+1 hits since last alert)|susanleeward.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "susanleeward.com"] [uri "/xmlrpc.php"] [unique_id "amR7FHrMPbZWNR_lpklkoQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-25 05:44:57
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 140.213.190.205 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 140.213.190.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 01:44:51.298720 2026] [security2:error] [pid 881180:tid 881180] [client 140.213.190.205:11459] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 140.213.190.205 (+1 hits since last alert)|adonamusic.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "adonamusic.com"] [uri "/xmlrpc.php"] [unique_id "amRNU8WnFvHMFfhOuXIRbQAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Steve
2026-07-23 09:31:22
(1 week ago)
Abuse of XMLRPC
Brute-Force
Web App Attack
🇪🇸
alferez
2026-07-23 07:57:24
(1 week ago)
xmlrpc.php attack DOS
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-07-23 06:58:14
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 140.213.190.205 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 140.213.190.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 02:58:07.151136 2026] [security2:error] [pid 1664676:tid 1664676] [client 140.213.190.205:9922] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 140.213.190.205 (+1 hits since last alert)|pearlhomesfw.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pearlhomesfw.com"] [uri "/xmlrpc.php"] [unique_id "amG7fx5y2WjwF1q39BqIkQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-23 05:46:33
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 140.213.190.205 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 140.213.190.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 01:46:26.294435 2026] [security2:error] [pid 2561832:tid 2561862] [client 140.213.190.205:12420] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 140.213.190.205 (+1 hits since last alert)|wedgwoodclub.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "wedgwoodclub.com"] [uri "/xmlrpc.php"] [unique_id "amGqshsr9XIo1jIdZY4Z_AAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-22 04:26:58
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 140.213.190.205 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 140.213.190.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 00:26:51.302925 2026] [security2:error] [pid 15091:tid 15112] [client 140.213.190.205:12896] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 140.213.190.205 (+1 hits since last alert)|davidholls.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "davidholls.com"] [uri "/xmlrpc.php"] [unique_id "amBGi2cT9scHzFB_KP9CjQAAAIo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-07-21 05:20:44
(1 week ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-21 05:02:08
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 140.213.190.205 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 140.213.190.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 01:02:01.390584 2026] [security2:error] [pid 13277:tid 13277] [client 140.213.190.205:17140] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 140.213.190.205 (+1 hits since last alert)|ucommsi.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ucommsi.com"] [uri "/xmlrpc.php"] [unique_id "al79SUIjyz4G02CPK3fIZwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-21 04:59:21
(1 week ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇮🇩
sockominfo
2026-07-19 16:00:52
(1 week ago)
Weekend login - Suspicious for Government. Threat Score: 7.3/10 (HIGH). Confidence: 50%. CVSS v3.1: ...
show more
Weekend login - Suspicious for Government. Threat Score: 7.3/10 (HIGH). Confidence: 50%. CVSS v3.1: 6.3/10 (Medium). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 87%. MITRE ATT&CK: T1071 (Application Layer Protocol). Tactic: TA0001. Freshness: Very Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
2026-07-14 18:02:57
(2 weeks ago)
Web attack
Bad Web Bot
Web App Attack
🇮🇩
David Koswari
2026-07-06 05:26:00
(3 weeks ago)
REQ_BLOCKED_ACL
DDoS Attack
FTP Brute-Force
Ping of Death
Port Scan
Hacking
SQL Injection
Spoofing
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
IoT Targeted