2026-06-28 18:17:16
(9 hours ago)
Blocked by ModSec and CSF
Port Scan
🇺🇸
TPI-Abuse
2026-06-28 10:52:45
(17 hours ago)
(mod_security) mod_security (id:240335) triggered by 149.30.146.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 149.30.146.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 06:52:42.857173 2026] [security2:error] [pid 1855:tid 1855] [client 149.30.146.146:11483] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 149.30.146.146 (+1 hits since last alert)|gemco-mfg.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "gemco-mfg.com"] [uri "/xmlrpc.php"] [unique_id "akD8-oV7jwiNjKsYszvUdgAAAEY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-06-28 10:08:15
(17 hours ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
US/United States/-
Web App Attack
🇫🇷
tecnicorioja
2026-06-27 22:00:29
(1 day ago)
POST /xmlrpc.php [27/Jun/2026:05:32:34
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-06-27 18:43:35
(1 day ago)
8.954 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-27 06:06:55
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 149.30.146.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 149.30.146.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 02:06:50.148912 2026] [security2:error] [pid 11638:tid 11638] [client 149.30.146.146:3297] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 149.30.146.146 (+1 hits since last alert)|eta-mct.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "eta-mct.com"] [uri "/xmlrpc.php"] [unique_id "aj9oehaMm91wQ_4EoQf9YAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-27 05:04:48
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 149.30.146.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 149.30.146.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 01:04:41.630492 2026] [security2:error] [pid 4330:tid 4330] [client 149.30.146.146:60128] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 149.30.146.146 (+1 hits since last alert)|marcosbarraza.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "marcosbarraza.net"] [uri "/xmlrpc.php"] [unique_id "aj9Z6Y7tNrpHYVMXmSCVxgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-06-26 17:40:29
(2 days ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇩🇪
Vegascosmetics
2026-06-26 14:46:08
(2 days ago)
(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security
DDoS Attack
Hacking
Exploited Host
🇩🇪
YF
2026-06-26 14:10:14
(2 days ago)
xmlrpc.php Potential DDoS or brute force
DDoS Attack
Brute-Force
2026-06-26 13:15:23
(2 days ago)
(wordpress) Failed wordpress login from 149.30.146.146 (PH/Philippines/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-06-26 12:58:58
(2 days ago)
(mod_security) mod_security (id:240335) triggered by 149.30.146.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 149.30.146.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 08:58:52.980849 2026] [security2:error] [pid 25195:tid 25195] [client 149.30.146.146:54859] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 149.30.146.146 (+1 hits since last alert)|apexandroids.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "apexandroids.com"] [uri "/xmlrpc.php"] [unique_id "aj53jCViTzysJOkZ3hHswgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-26 10:00:50
(2 days ago)
[ns3.backorder.gr] httpd-xmlrpc-post: sites=blazos.com; logs=/var/log/httpd/domains/blazos.com.log; ...
show more
[ns3.backorder.gr] httpd-xmlrpc-post: sites=blazos.com; logs=/var/log/httpd/domains/blazos.com.log; samples=/xmlrpc.php
show less
Brute-Force
Web App Attack
2026-06-26 09:51:52
(2 days ago)
Attac
Brute-Force
🇺🇸
TPI-Abuse
2026-06-26 09:24:19
(2 days ago)
(mod_security) mod_security (id:240335) triggered by 149.30.146.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 149.30.146.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 05:24:13.714438 2026] [security2:error] [pid 19982:tid 19982] [client 149.30.146.146:41532] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 149.30.146.146 (+1 hits since last alert)|vzan.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "vzan.org"] [uri "/xmlrpc.php"] [unique_id "aj5FPYzP0qWczu6cK7uC5AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack