🇩🇪
konseptit
2026-07-28 08:35:43
(8 hours ago)
(wordpress) Failed wordpress login from 185.158.20.1 (IQ/Iraq/-)
Brute-Force
🇺🇸
RH5
2026-07-27 16:53:00
(1 day ago)
Restricted URL probing (/xmlrpc.php) (UTC 2026-07-27 16:53)
Web App Attack
🇺🇸
TPI-Abuse
2026-07-26 17:45:26
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 185.158.20.1 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 185.158.20.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 13:45:20.109358 2026] [security2:error] [pid 3316763:tid 3316763] [client 185.158.20.1:29511] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 185.158.20.1 (+1 hits since last alert)|glassclublake.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "glassclublake.com"] [uri "/xmlrpc.php"] [unique_id "amZHsOpAwePyZJdYiVDCxAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-25 17:08:09
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 185.158.20.1 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 185.158.20.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 13:08:03.660530 2026] [security2:error] [pid 943103:tid 943103] [client 185.158.20.1:5715] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 185.158.20.1 (+1 hits since last alert)|boaredraven.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "boaredraven.com"] [uri "/xmlrpc.php"] [unique_id "amTtc_tOby07TmB5xpB_xgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-25 12:29:43
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 185.158.20.1 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 185.158.20.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 08:29:35.979032 2026] [security2:error] [pid 3916392:tid 3916392] [client 185.158.20.1:51113] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 185.158.20.1 (+1 hits since last alert)|livingawakenedbook.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "livingawakenedbook.com"] [uri "/xmlrpc.php"] [unique_id "amSsL_7EwihH7-M7d1gNmQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-23 05:19:08
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 185.158.20.1 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 185.158.20.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 01:19:02.969123 2026] [security2:error] [pid 2250817:tid 2250817] [client 185.158.20.1:23667] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.med-engineering.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.med-engineering.com"] [uri "/pro.com"] [unique_id "amGkRhZIopgkLczEI7a10QAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
stechusa
2026-07-20 23:07:54
(1 week ago)
ELEVATED_THREAT | 526 IPs targeting /brand.html | URL template shared by 7 IPs: /brand.html?bulb_sha ...
show more
ELEVATED_THREAT | 526 IPs targeting /brand.html | URL template shared by 7 IPs: /brand.html?bulb_shape=*&bulb_type=*&glass=*&mode=list&p=* | Facet request during elevated threat (facet_ratio=0.97, unique_ips=769)
show less
Bad Web Bot
DDoS Attack
🇳🇱
e.fierstra
2026-07-20 18:18:14
(1 week ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-07-20 15:03:16
(1 week ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-18 08:33:34
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 185.158.20.1 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 185.158.20.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 04:33:29.032055 2026] [security2:error] [pid 3498:tid 3498] [client 185.158.20.1:15966] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 185.158.20.1 (+1 hits since last alert)|elgar.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "elgar.us"] [uri "/xmlrpc.php"] [unique_id "als6WbqNxEV5k7TVu276IgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
synthient
2026-07-17 08:22:58
(1 week ago)
Earnify Botnet DDoS Attack July 17th. IOCs: https://github.com/deepfield/public-research/tree/main/m ...
show more
Earnify Botnet DDoS Attack July 17th. IOCs: https://github.com/deepfield/public-research/tree/main/maskify
show less
Brute-Force
DDoS Attack
2026-07-12 09:59:15
(2 weeks ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show more
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-skip.asp
show less
Exploited Host
Bad Web Bot
🇪🇸
masterguru
2026-07-09 14:33:57
(2 weeks ago)
(xmlrpc) Failed xmlrpc access from 185.158.20.1 (IQ/Iraq/-): 5 in the last 3600 secs (0-122)
Hacking
🇰🇷
zlhIcd
2026-06-30 02:48:03
(4 weeks ago)
185.158.20.1 - - [16/Jun/2026:12:27:04 +0900] "GET /pcwiki/index.php?days=30&from=20251126234048&hid ...
show more
185.158.20.1 - - [16/Jun/2026:12:27:04 +0900] "GET /pcwiki/index.php?days=30&from=20251126234048&hideliu=1&limit=50&title=%ED%8A%B9%EC%88%98%EA%B8%B0%EB%8A%A5:%EB%A7%81%ED%81%AC%EC%B5%9C%EA%B7%BC%EB%B0%94%EB%80%9C HTTP/1.1" 404 460 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 15.0; rv:134.0) Gecko/20100101 Firefox/134.0"
...
show less
Web Spam
SQL Injection
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-06-29 07:51:29
(4 weeks ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot