🇺🇸
TPI-Abuse
2026-06-04 13:40:24
(20 hours ago)
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 09:40:10.317862 2026] [security2:error] [pid 8577:tid 8577] [client 36.70.94.219:6753] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 36.70.94.219 (+1 hits since last alert)|stinsonbeachsurfandkayak.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "stinsonbeachsurfandkayak.com"] [uri "/xmlrpc.php"] [unique_id "aiGAOrpmNNIMF3sOofLhZgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ConsulHosting
2026-06-04 11:41:20
(22 hours ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇩🇪
PHAM
2026-06-04 10:53:11
(23 hours ago)
Shield Guard: Scanner: wordpress (+70) | Chemin suspect: /xmlrpc.php | xmlrpc.php bloqué
Web App Attack
Port Scan
🇺🇸
TPI-Abuse
2026-06-04 10:26:21
(23 hours ago)
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 06:26:06.517015 2026] [security2:error] [pid 17165:tid 17165] [client 36.70.94.219:50430] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 36.70.94.219 (+1 hits since last alert)|infinityartistsgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "infinityartistsgroup.com"] [uri "/xmlrpc.php"] [unique_id "aiFSviOJ-WZdaSJjRPm5cwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-04 09:53:04
(1 day ago)
(wordpress) Failed wordpress login from 36.70.94.219 (ID/Indonesia/-)
Brute-Force
🇺🇸
BlueStem123
2026-06-04 08:00:38
(1 day ago)
Automated scanner targeting WordPress installations. Source produced sustained scanning activity exc ...
show more
Automated scanner targeting WordPress installations. Source produced sustained scanning activity exceeding 100 requests within a 60-minute window.
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-04 07:31:28
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 03:31:15.190428 2026] [security2:error] [pid 22316:tid 22316] [client 36.70.94.219:57207] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 36.70.94.219 (+1 hits since last alert)|oogeothermal.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "oogeothermal.com"] [uri "/xmlrpc.php"] [unique_id "aiEpw_bBUQaQZOwbkJzB_gAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-06-04 06:06:05
(1 day ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: crowdsecurity/http-bf-wordpress_bf_xmlr ...
show more
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: crowdsecurity/http-bf-wordpress_bf_xmlrpc.
show less
Bad Web Bot
Web App Attack
🇬🇧
Apache
2026-06-04 05:46:29
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (ID/Indonesia/-): 5 in the last 30 ...
show more
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (ID/Indonesia/-): 5 in the last 300 secs
show less
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-06-04 04:14:12
(1 day ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
2026-06-04 03:13:10
(1 day ago)
Attac
Brute-Force
🇺🇸
TPI-Abuse
2026-06-04 01:50:46
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 21:50:29.383042 2026] [security2:error] [pid 13831:tid 13831] [client 36.70.94.219:32511] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 36.70.94.219 (+1 hits since last alert)|pharmaceuticalsalescertifications.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pharmaceuticalsalescertifications.com"] [uri "/xmlrpc.php"] [unique_id "aiDZ5RY4AQCsHcvtS0PDmAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2026-06-03 18:56:42
(1 day ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-03 18:27:19
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 14:27:03.493064 2026] [security2:error] [pid 16447:tid 16447] [client 36.70.94.219:54902] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 36.70.94.219 (+1 hits since last alert)|cosplayculture.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "cosplayculture.com"] [uri "/xmlrpc.php"] [unique_id "aiBx9wyu_6dfvTM_AEAM_gAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-03 12:19:01
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 36.70.94.219 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 08:18:46.190925 2026] [security2:error] [pid 24189:tid 24189] [client 36.70.94.219:64454] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 36.70.94.219 (+1 hits since last alert)|geodogs.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "geodogs.org"] [uri "/xmlrpc.php"] [unique_id "aiAbpkle_Zz-4juXoO72mAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack