🇩🇪
nyuuzyou
2026-09-10 21:40:28
(4 weeks ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on applic ...
show more
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-09-10T21:40:28Z.
show less
Bad Web Bot
🇺🇸
kosada.com
2026-08-21 19:09:10
(1 month ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
2026-07-11 16:34:00
(2 months ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show more
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in printer-friendly.asp
show less
Exploited Host
Bad Web Bot
🇺🇸
kosada.com
2026-07-06 15:11:28
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇧🇪
cmbplf
2026-06-22 22:29:11
(3 months ago)
3.749 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot
🇫🇷
dynamix
2026-06-22 18:25:56
(3 months ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 15:21:37
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 186.225.35.38 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 186.225.35.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 11:21:30.672443 2026] [security2:error] [pid 15186:tid 15186] [client 186.225.35.38:28586] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 186.225.35.38 (+1 hits since last alert)|churchbehindthewalls.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "churchbehindthewalls.com"] [uri "/xmlrpc.php"] [unique_id "ajlS-orcXdCbVa_yiozbtgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Marc
2026-06-22 15:18:53
(3 months ago)
186.225.35.38 - - [22/Jun/2026:17:18:31 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3466 "-" "Jetpack/12. ...
show more
186.225.35.38 - - [22/Jun/2026:17:18:31 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3466 "-" "Jetpack/12.1; WordPress/6.3; http://site30810413.com" 186.225.35.38 - - [22/Jun/2026:17:18:41 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3467 "-" "WordPress.com; https://wordpress.com" 186.225.35.38 - - [22/Jun/2026:17:18:52 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3465 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.1)"
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 13:21:16
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 186.225.35.38 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 186.225.35.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 09:21:10.735924 2026] [security2:error] [pid 32410:tid 32410] [client 186.225.35.38:28652] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 186.225.35.38 (+1 hits since last alert)|cynosurehomeservices.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "cynosurehomeservices.com"] [uri "/xmlrpc.php"] [unique_id "ajk2xuskLyU_3SpyckNV3QAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-18 12:48:32
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 186.225.35.38 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 186.225.35.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 08:48:28.079079 2026] [security2:error] [pid 12534:tid 12534] [client 186.225.35.38:28579] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 186.225.35.38 (+1 hits since last alert)|pakistanvision.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pakistanvision.com"] [uri "/xmlrpc.php"] [unique_id "ajPpHCHmbqI9ZlIR_FLHBQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 22:27:39
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 186.225.35.38 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 186.225.35.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 18:27:32.526462 2026] [security2:error] [pid 16940:tid 16940] [client 186.225.35.38:28500] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 186.225.35.38 (+1 hits since last alert)|paguilar.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "paguilar.com"] [uri "/xmlrpc.php"] [unique_id "ajMfVDjizcBeaa_oPVsGiQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-06-17 21:47:35
(3 months ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇦🇹
bsbt
2026-06-17 20:18:00
(3 months ago)
Web App Attack
2026-06-16 22:15:55
(3 months ago)
[osotir.org] httpd-xmlrpc-post: sites=drasimas.gr; logs=/var/log/httpd/domains/drasimas.gr.log; samp ...
show more
[osotir.org] httpd-xmlrpc-post: sites=drasimas.gr; logs=/var/log/httpd/domains/drasimas.gr.log; samples=/xmlrpc.php
show less
Brute-Force
Web App Attack
🇦🇺
screwlooseit.com.au
2026-06-16 20:37:10
(3 months ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
BR/Brazil/-
Web App Attack
