🇺🇸
TPI-Abuse
2026-06-09 00:20:27
(4 hours ago)
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 20:20:22.757283 2026] [security2:error] [pid 962:tid 962] [client 195.229.76.26:61614] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 195.229.76.26 (+1 hits since last alert)|wild-goose.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "wild-goose.net"] [uri "/xmlrpc.php"] [unique_id "aidcRi3Wz6vlZmeLOeDT0QAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 23:19:32
(5 hours ago)
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 19:19:26.920754 2026] [security2:error] [pid 23778:tid 23778] [client 195.229.76.26:49688] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 195.229.76.26 (+1 hits since last alert)|agworldmissions.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "agworldmissions.org"] [uri "/xmlrpc.php"] [unique_id "aidN_uqV4IR1_36zr8QuMgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
alferez
2026-06-08 19:16:11
(9 hours ago)
Hacking
Exploited Host
Web App Attack
2026-06-08 19:08:40
(9 hours ago)
Attac
Brute-Force
🇺🇸
TPI-Abuse
2026-06-08 17:42:29
(10 hours ago)
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 13:42:25.218816 2026] [security2:error] [pid 27355:tid 27355] [client 195.229.76.26:61784] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 195.229.76.26 (+1 hits since last alert)|tgaguide.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tgaguide.com"] [uri "/xmlrpc.php"] [unique_id "aib_AVKMAdS9iulHAJ1UOwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-06-08 17:26:13
(10 hours ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-06-08 15:44:06
(12 hours ago)
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 11:43:58.641899 2026] [security2:error] [pid 9400:tid 9400] [client 195.229.76.26:50852] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 195.229.76.26 (+1 hits since last alert)|bamedica.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "bamedica.com"] [uri "/xmlrpc.php"] [unique_id "aibjPtyhLVGA2wqxyCE2YQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-08 13:08:23
(15 hours ago)
[redacted] 195.229.76.26 - - [08/Jun/2026:15:07:39 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "W ...
show more
[redacted] 195.229.76.26 - - [08/Jun/2026:15:07:39 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 195.229.76.26 - - [08/Jun/2026:15:07:49 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 195.229.76.26 - - [08/Jun/2026:15:08:00 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 195.229.76.26 - - [08/Jun/2026:15:08:11 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.5; WordPress/6.2; http://site75460222.com"
[redacted] 195.229.76.26 - - [08/Jun/2026:15:08:21 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2)"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 12:03:00
(16 hours ago)
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 08:02:52.381116 2026] [security2:error] [pid 2860:tid 2860] [client 195.229.76.26:56216] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 195.229.76.26 (+1 hits since last alert)|casapapayasanmiguel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "casapapayasanmiguel.com"] [uri "/xmlrpc.php"] [unique_id "aiavbFZTcbbS2z9Y3z3VDwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
bittiguru.fi
2026-06-08 07:09:27
(21 hours ago)
195.229.76.26 - [08/Jun/2026:10:09:17 +0300] "POST /xmlrpc.php HTTP/1.1" 200 428 "-" "Jetpack by Wor ...
show more
195.229.76.26 - [08/Jun/2026:10:09:17 +0300] "POST /xmlrpc.php HTTP/1.1" 200 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.2)" "-"
195.229.76.26 - [08/Jun/2026:10:09:27 +0300] "POST /xmlrpc.php HTTP/1.1" 200 428 "-" "WordPress.com; https://wordpress.com" "-"
...
show less
Hacking
Brute-Force
Web App Attack
🇫🇮
bittiguru.fi
2026-06-08 06:54:16
(21 hours ago)
195.229.76.26 - [08/Jun/2026:09:54:07 +0300] "POST /xmlrpc.php HTTP/1.1" 200 428 "-" "Jetpack/12.5; ...
show more
195.229.76.26 - [08/Jun/2026:09:54:07 +0300] "POST /xmlrpc.php HTTP/1.1" 200 428 "-" "Jetpack/12.5; WordPress/6.4; http://site96554125.com" "-"
195.229.76.26 - [08/Jun/2026:09:54:15 +0300] "POST /xmlrpc.php HTTP/1.1" 200 428 "-" "Jetpack/13.0; WordPress/6.3; http://site71357047.com" "-"
...
show less
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 06:00:27
(22 hours ago)
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 02:00:20.116745 2026] [security2:error] [pid 1330:tid 1330] [client 195.229.76.26:57993] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 195.229.76.26 (+1 hits since last alert)|fusionrep.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "fusionrep.com"] [uri "/xmlrpc.php"] [unique_id "aiZadE8N5x74sHpeQrw4LgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 05:27:04
(22 hours ago)
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 01:26:57.711420 2026] [security2:error] [pid 1620:tid 1620] [client 195.229.76.26:51412] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 195.229.76.26 (+1 hits since last alert)|matt-bechtel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "matt-bechtel.com"] [uri "/xmlrpc.php"] [unique_id "aiZSoaNGIVznCmf2JtLOIgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-08 00:57:35
(1 day ago)
Fail2Ban - Wordpress brute-force
...
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 23:08:30
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 195.229.76.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 19:08:25.386540 2026] [security2:error] [pid 3403:tid 3403] [client 195.229.76.26:59931] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 195.229.76.26 (+1 hits since last alert)|keychainfilms.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "keychainfilms.com"] [uri "/xmlrpc.php"] [unique_id "aiX56QUZ6SprDtPpgBd-ugAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack