🇺🇸
cwytech
2026-06-19 11:25:10
(11 hours ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-18 17:41:21
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net. ...
show more
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 13:41:14.505909 2026] [security2:error] [pid 20170:tid 20170] [client 201.33.62.110:50707] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 201.33.62.110 (+1 hits since last alert)|passy.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "passy.us"] [uri "/xmlrpc.php"] [unique_id "ajQtuudFjjfpuq2sbLmnRgAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 18:02:49
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net. ...
show more
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 14:02:45.376250 2026] [security2:error] [pid 22765:tid 22797] [client 201.33.62.110:52986] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 201.33.62.110 (+1 hits since last alert)|whatismetamodern.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "whatismetamodern.com"] [uri "/xmlrpc.php"] [unique_id "ajA-RWrGd0hRg79DXD_N-gAAAQM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 14:08:44
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net. ...
show more
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 10:08:40.602456 2026] [security2:error] [pid 9903:tid 9903] [client 201.33.62.110:60581] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 201.33.62.110 (+1 hits since last alert)|wwfstudio.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "wwfstudio.com"] [uri "/xmlrpc.php"] [unique_id "ajAHaHwHk7F58Zn2W0ytlAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
konseptit
2026-06-11 09:29:43
(1 week ago)
(wordpress) Failed wordpress login from 201.33.62.110 (BR/Brazil/porta110.major.as28624.oops.net.br)
Brute-Force
🇺🇸
TPI-Abuse
2026-06-11 09:00:26
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net. ...
show more
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 05:00:19.531091 2026] [security2:error] [pid 9297:tid 9297] [client 201.33.62.110:51469] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 201.33.62.110 (+1 hits since last alert)|radicalchange.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "radicalchange.org"] [uri "/xmlrpc.php"] [unique_id "aip5I8Efz8GJlIeb9U14OQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 20:11:21
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net. ...
show more
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 16:11:13.580225 2026] [security2:error] [pid 2210:tid 2210] [client 201.33.62.110:50227] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 201.33.62.110 (+1 hits since last alert)|arsenalfordemocracy.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "arsenalfordemocracy.com"] [uri "/xmlrpc.php"] [unique_id "ainE4fMDriMu4thSApp7mAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 16:48:29
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net. ...
show more
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 12:48:23.781333 2026] [security2:error] [pid 21826:tid 21826] [client 201.33.62.110:55375] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 201.33.62.110 (+1 hits since last alert)|designingdestinynow.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "designingdestinynow.com"] [uri "/xmlrpc.php"] [unique_id "aihD14nQNDHPenaep-dOcAAAADA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 20:25:10
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net. ...
show more
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 16:25:03.466629 2026] [security2:error] [pid 19699:tid 19699] [client 201.33.62.110:51449] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 201.33.62.110 (+1 hits since last alert)|495metro.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "495metro.com"] [uri "/xmlrpc.php"] [unique_id "aiclH2xZZo_8LFFd4ZTVXgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 19:52:58
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net. ...
show more
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 15:52:52.296247 2026] [security2:error] [pid 25979:tid 25979] [client 201.33.62.110:64813] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 201.33.62.110 (+1 hits since last alert)|k2servicesinc.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "k2servicesinc.net"] [uri "/xmlrpc.php"] [unique_id "aicdlHTasOfK9g5-Q86sswAAAGo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-08 14:24:10
(1 week ago)
Attac
Brute-Force
2026-05-25 14:05:49
(3 weeks ago)
Blocked: Reason='Vulnerability probing — PHP scan detected (44/60 min)'; Requests=44
Port Scan
🇺🇸
TPI-Abuse
2026-05-13 13:09:34
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net. ...
show more
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 09:09:27.594742 2026] [security2:error] [pid 11300:tid 11300] [client 201.33.62.110:56836] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 201.33.62.110 (+1 hits since last alert)|lakependoreillemobility.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "lakependoreillemobility.com"] [uri "/xmlrpc.php"] [unique_id "agR4B_k1wWW_a2EreATpbQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Lunix
2026-05-04 17:41:19
(1 month ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-02 15:42:12
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net. ...
show more
(mod_security) mod_security (id:240335) triggered by 201.33.62.110 (porta110.major.as28624.oops.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 11:42:06.144166 2026] [security2:error] [pid 27060:tid 27060] [client 201.33.62.110:50643] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 201.33.62.110 (+1 hits since last alert)|rockinr.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rockinr.org"] [uri "/xmlrpc.php"] [unique_id "afYbTlT0pRsWMFMMQPwAFwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack