2026-06-17 18:04:31
(1 week ago)
Bad Web Bot
Web App Attack
2026-06-17 12:25:56
(1 week ago)
(wordpress) Failed wordpress login from 204.14.250.113 (AI/Anguilla/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-06-17 10:31:14
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 06:31:06.547800 2026] [security2:error] [pid 22385:tid 22385] [client 204.14.250.113:62936] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 204.14.250.113 (+1 hits since last alert)|blindshine.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "blindshine.com"] [uri "/xmlrpc.php"] [unique_id "ajJ3agaFnSREf95NHjF4SQAAADQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 08:24:49
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 04:24:43.560421 2026] [security2:error] [pid 13876:tid 13876] [client 204.14.250.113:54672] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 204.14.250.113 (+1 hits since last alert)|mirai-labo.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "mirai-labo.com"] [uri "/xmlrpc.php"] [unique_id "ajJZy6uy329XEosvqAcKbgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 07:23:33
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 03:23:28.586328 2026] [security2:error] [pid 5102:tid 5102] [client 204.14.250.113:58308] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 204.14.250.113 (+1 hits since last alert)|lambert-heating-and-air.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "lambert-heating-and-air.com"] [uri "/xmlrpc.php"] [unique_id "ajJLcGOz6g7tkr7vPphDWwAAAFE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 06:56:11
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 02:56:04.743695 2026] [security2:error] [pid 28933:tid 28933] [client 204.14.250.113:59010] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 204.14.250.113 (+1 hits since last alert)|cosplayculture.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "cosplayculture.com"] [uri "/xmlrpc.php"] [unique_id "ajJFBPB-BGzm6npnJOi3mgAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-16 20:22:37
(1 week ago)
[redacted] 204.14.250.113 - - [16/Jun/2026:22:21:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" " ...
show more
[redacted] 204.14.250.113 - - [16/Jun/2026:22:21:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.2)"
[redacted] 204.14.250.113 - - [16/Jun/2026:22:21:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack/12.5; WordPress/6.3; http://site43225459.com"
[redacted] 204.14.250.113 - - [16/Jun/2026:22:22:03 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack by WordPress.com"
[redacted] 204.14.250.113 - - [16/Jun/2026:22:22:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack by WordPress.com"
[redacted] 204.14.250.113 - - [16/Jun/2026:22:22:13 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "WordPress.com; https://wordpress.com"
[redacted] 204.14.250.113 - - [16/Jun/2026:22:22:15 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack/12.1; WordPress/6.1; http://site25589643.com"
[redacted] 204.14.250.113 - - [16/Jun/2026:22:22:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack by WordPress.com"
[redacted] 204.14.250
...
show less
Hacking
Web App Attack
🇺🇸
lostswordfish.com
2026-06-16 16:54:03
(1 week ago)
Wordfence waf block on kcuar
Web App Attack
🇩🇪
LRob.fr
2026-06-16 13:00:07
(1 week ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-16 12:48:02
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 08:47:58.125904 2026] [security2:error] [pid 17008:tid 17008] [client 204.14.250.113:58201] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 204.14.250.113 (+1 hits since last alert)|pharmaceuticalsalescareerhub.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pharmaceuticalsalescareerhub.com"] [uri "/xmlrpc.php"] [unique_id "ajFF_gjIqp4IicbMjZfbGwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-16 11:16:14
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 07:16:08.415866 2026] [security2:error] [pid 10152:tid 10152] [client 204.14.250.113:59782] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 204.14.250.113 (+1 hits since last alert)|baliaccommodationpadangpadang.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "baliaccommodationpadangpadang.com"] [uri "/xmlrpc.php"] [unique_id "ajEweOBEEFCLx_m_aRJc_gAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-16 10:17:32
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 06:17:28.695986 2026] [security2:error] [pid 3494:tid 3494] [client 204.14.250.113:51798] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 204.14.250.113 (+1 hits since last alert)|marianozaro.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "marianozaro.com"] [uri "/xmlrpc.php"] [unique_id "ajEiuGy7B08CdSTH2aiXmQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
integrantservices.com
2026-06-16 08:36:57
(1 week ago)
(wordpress) Failed wordpress login from 204.14.250.113 (AI/Anguilla/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-06-16 05:57:08
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 204.14.250.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 01:56:57.397275 2026] [security2:error] [pid 7220:tid 7220] [client 204.14.250.113:55873] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 204.14.250.113 (+1 hits since last alert)|microkerneltechnologies.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "microkerneltechnologies.com"] [uri "/xmlrpc.php"] [unique_id "ajDlqcEA0RZW5xkSYTT4GgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
grassau.com
2026-06-16 05:51:14
(1 week ago)
(wordpress) Failed wordpress login from 204.14.250.113 (AI/Anguilla/-/The Valley/-)
Brute-Force