🇺🇸
TPI-Abuse
2026-07-11 17:24:32
(1 hour ago)
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 13:24:25.553143 2026] [security2:error] [pid 9576:tid 9576] [client 176.204.4.160:55325] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 176.204.4.160 (+1 hits since last alert)|pcga.golf|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pcga.golf"] [uri "/xmlrpc.php"] [unique_id "alJ8SdVd3Tji2jWDpWikbAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-11 17:22:28
(1 hour ago)
(wordpress) Failed wordpress login from 176.204.4.160 (AE/United Arab Emirates/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-07-11 15:22:30
(3 hours ago)
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 11:22:25.538021 2026] [security2:error] [pid 6070:tid 6070] [client 176.204.4.160:49384] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 176.204.4.160 (+1 hits since last alert)|nolaanime.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nolaanime.com"] [uri "/xmlrpc.php"] [unique_id "alJfsXps4PDnxvbvuTjKgAAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-07-11 14:37:46
(3 hours ago)
CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc | req: ["/xmlrpc.php"] | UA: ["WordPress.com; ht ...
show more
CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc | req: ["/xmlrpc.php"] | UA: ["WordPress.com; https://wordpress.com","Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.2)","Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-11 13:07:06
(5 hours ago)
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 09:07:00.986414 2026] [security2:error] [pid 3687:tid 3687] [client 176.204.4.160:54654] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 176.204.4.160 (+1 hits since last alert)|fishleadership.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "fishleadership.org"] [uri "/xmlrpc.php"] [unique_id "alI_9HQ_R067pH1yZRk7-wAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-11 11:05:29
(7 hours ago)
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 07:05:23.360886 2026] [security2:error] [pid 9865:tid 9865] [client 176.204.4.160:54270] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 176.204.4.160 (+1 hits since last alert)|shannonraevocalstudio.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "shannonraevocalstudio.com"] [uri "/xmlrpc.php"] [unique_id "alIjc4ZIQqub7kaCObalAgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-11 10:07:00
(8 hours ago)
176.204.4.160 - - [11/Jul/2026:12:06:48 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428
176.204.4.160 - - ...
show more
176.204.4.160 - - [11/Jul/2026:12:06:48 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428
176.204.4.160 - - [11/Jul/2026:12:06:58 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428
...
show less
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-11 07:55:09
(10 hours ago)
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 03:55:02.215745 2026] [security2:error] [pid 16756:tid 16834] [client 176.204.4.160:50684] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 176.204.4.160 (+1 hits since last alert)|tnccivic.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tnccivic.org"] [uri "/xmlrpc.php"] [unique_id "alH21nkoiTITp3ycXFoVEgAAAYI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-11 06:07:16
(12 hours ago)
Trying to access config files
Web App Attack
🇺🇸
TPI-Abuse
2026-07-11 05:58:48
(12 hours ago)
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 01:58:40.189711 2026] [security2:error] [pid 20500:tid 20500] [client 176.204.4.160:65192] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 176.204.4.160 (+1 hits since last alert)|climasyequipos.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "climasyequipos.com"] [uri "/xmlrpc.php"] [unique_id "alHbkLhN-lk_tNj0bC0LIwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
applemooz
2026-07-11 03:09:20
(15 hours ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-07-11 00:30:44
(17 hours ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇬🇧
Apache
2026-07-11 00:16:17
(18 hours ago)
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (AE/United Arab Emirates/-): 5 in ...
show more
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (AE/United Arab Emirates/-): 5 in the last 300 secs
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-10 22:08:04
(20 hours ago)
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 18:08:00.559110 2026] [security2:error] [pid 13679:tid 13679] [client 176.204.4.160:60921] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 176.204.4.160 (+1 hits since last alert)|bosdkbook.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "bosdkbook.com"] [uri "/xmlrpc.php"] [unique_id "alFtQAa2CbKgSpwX_8u18gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-10 18:39:10
(23 hours ago)
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 176.204.4.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 14:39:05.533164 2026] [security2:error] [pid 30513:tid 30513] [client 176.204.4.160:63698] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 176.204.4.160 (+1 hits since last alert)|cmcnow.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "cmcnow.net"] [uri "/xmlrpc.php"] [unique_id "alE8SV6t7y5t1SUyEvw4OwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack