2026-05-28 06:46:24
(2 weeks ago)
Failed Wordpress Logins
Web App Attack
2026-05-26 21:46:12
(2 weeks ago)
Failed Wordpress Logins
Web App Attack
2026-05-25 12:24:21
(2 weeks ago)
Failed Wordpress Logins
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 12:20:45
(2 weeks ago)
(mod_security) mod_security (id:240335) triggered by 181.41.206.102 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 181.41.206.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 08:20:39.108278 2026] [security2:error] [pid 16235:tid 16235] [client 181.41.206.102:24032] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 181.41.206.102 (+1 hits since last alert)|desertalfas.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "desertalfas.org"] [uri "/xmlrpc.php"] [unique_id "ahQ-l2d8o94P47Zm0DonGAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob.fr
2026-05-25 11:30:08
(2 weeks ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇩🇪
LRob.fr
2026-05-25 11:00:09
(2 weeks ago)
Repeated 403 errors, blocked by Fail2ban in custom-403 jail
Bad Web Bot
🇩🇪
LRob.fr
2026-05-25 10:45:03
(2 weeks ago)
Repeated attacks detected by Fail2Ban in recidive jail
Hacking
🇺🇸
TPI-Abuse
2026-05-25 10:15:38
(2 weeks ago)
(mod_security) mod_security (id:240335) triggered by 181.41.206.102 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 181.41.206.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 06:15:34.132599 2026] [security2:error] [pid 3355:tid 3355] [client 181.41.206.102:6182] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 181.41.206.102 (+1 hits since last alert)|cmcnow.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "cmcnow.net"] [uri "/xmlrpc.php"] [unique_id "ahQhRhot8xS7pgRCGGe5fgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 09:34:04
(2 weeks ago)
(mod_security) mod_security (id:240335) triggered by 181.41.206.102 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 181.41.206.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 05:33:56.417478 2026] [security2:error] [pid 24612:tid 24612] [client 181.41.206.102:1090] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 181.41.206.102 (+1 hits since last alert)|erikageyama.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "erikageyama.com"] [uri "/xmlrpc.php"] [unique_id "ahQXhHg2fVbwya6VxEWZ7wAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 08:36:09
(2 weeks ago)
(mod_security) mod_security (id:240335) triggered by 181.41.206.102 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 181.41.206.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 04:36:01.012774 2026] [security2:error] [pid 21841:tid 21841] [client 181.41.206.102:24205] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 181.41.206.102 (+1 hits since last alert)|bbproductionsonline.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "bbproductionsonline.com"] [uri "/xmlrpc.php"] [unique_id "ahQJ8a88mFWnaunz9IUopgAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-05-25 08:28:15
(2 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 25
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 07:55:20
(2 weeks ago)
(mod_security) mod_security (id:240335) triggered by 181.41.206.102 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 181.41.206.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 03:55:13.038642 2026] [security2:error] [pid 24248:tid 24354] [client 181.41.206.102:62972] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 181.41.206.102 (+1 hits since last alert)|blog.stonyp.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "blog.stonyp.com"] [uri "/xmlrpc.php"] [unique_id "ahQAYQSDfgEHeFBqWbRMUAAAAlM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 06:18:34
(2 weeks ago)
(mod_security) mod_security (id:240335) triggered by 181.41.206.102 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 181.41.206.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 02:18:28.921412 2026] [security2:error] [pid 10573:tid 10573] [client 181.41.206.102:22976] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 181.41.206.102 (+1 hits since last alert)|carolinafootprints.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "carolinafootprints.com"] [uri "/xmlrpc.php"] [unique_id "ahPptJ04ddOqKc75_q50xgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-25 05:37:24
(2 weeks ago)
CMS (WordPress or Joomla) brute force attempt.
Brute-Force
🇨🇭
Origon
2026-05-25 05:07:36
(2 weeks ago)
http-bf-wordpress_bf - IP: 181.41.206.102 - time="2026-05-25T07:07:36+02:00" level=info msg="(555f6 ...
show more
http-bf-wordpress_bf - IP: 181.41.206.102 - time="2026-05-25T07:07:36+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-bf-wordpress_bf by ip 181.41.206.102 (US/174) : 4h ban on Ip 181.41.206.102" module=db
show less
Web App Attack