🇺🇸
Victor López
2026-06-06 16:15:03
(1 day ago)
buscaempresas.co 37.228.129.241 - - [06/Jun/2026:11:15:00 -0500] "POST /xmlrpc.php HTTP/1.1" 405 552 ...
show more
buscaempresas.co 37.228.129.241 - - [06/Jun/2026:11:15:00 -0500] "POST /xmlrpc.php HTTP/1.1" 405 552 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"
buscaempresas.co 37.228.129.241 - - [06/Jun/2026:11:15:01 -0500] "POST /xmlrpc.php HTTP/1.1" 405 552 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"
buscaempresas.co 37.228.129.241 - - [06/Jun/2026:11:15:02 -0500] "POST /xmlrpc.php HTTP/1.1" 405 552 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"
...
show less
Hacking
Web App Attack
🇺🇸
mnsf
2026-06-04 12:05:55
(3 days ago)
Abuse Detected (1)
Brute-Force
Web App Attack
2026-06-03 04:46:03
(5 days ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇧🇪
cmbplf
2026-06-01 00:31:31
(1 week ago)
508 limiting connections by zone (1h39m59s)
DDoS Attack
🇺🇸
TPI-Abuse
2026-05-31 18:47:45
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 37.228.129.241 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 37.228.129.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 14:47:39.832783 2026] [security2:error] [pid 19004:tid 19004] [client 37.228.129.241:51362] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||killeramps.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "killeramps.com"] [uri "/dump.sql"] [unique_id "ahyCS2PIPch4u_EC1pnZjQAAABE"], referer: killeramps.com/dump.sql
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-31 18:16:07
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 37.228.129.241 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 37.228.129.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 14:16:02.461469 2026] [security2:error] [pid 14704:tid 14798] [client 37.228.129.241:52834] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.sattraffic.net"] [uri "/.git/config"] [unique_id "ahx64jpq77hNvGQHnI-uBwAAAMc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-05-30 23:46:29
(1 week ago)
Try to access /xmlrpc.php
Web App Attack
🇨🇦
leithzz
2026-05-30 18:34:36
(1 week ago)
Report by Cloudflare.Time: 2026-05-30T18:33:46Z
DDoS Attack
🇺🇸
TPI-Abuse
2026-05-30 04:46:48
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 37.228.129.241 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 37.228.129.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 30 00:46:40.402928 2026] [security2:error] [pid 21798:tid 21798] [client 37.228.129.241:48794] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mariedjones.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mariedjones.com"] [uri "/dump.sql"] [unique_id "ahprsAmIzWIz3Jg2QRzNmQAAAAY"], referer: mariedjones.com/dump.sql
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nowyouknow
2026-05-30 04:46:11
(1 week ago)
Phishing
Web Spam
🇺🇸
TPI-Abuse
2026-05-29 13:30:51
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 37.228.129.241 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 37.228.129.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 09:30:45.775898 2026] [security2:error] [pid 11492:tid 11492] [client 37.228.129.241:41402] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||anneoday.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "anneoday.com"] [uri "/dump.sql"] [unique_id "ahmVBZNcB54AWuDX6IzM_AAAAA4"], referer: anneoday.com/dump.sql
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-05-29 08:12:40
(1 week ago)
[FriMay2910:12:35.4935902026][security2:error][pid1904483:tid1904553][client37.228.129.241:0]ModSecu ...
show more
[FriMay2910:12:35.4935902026][security2:error][pid1904483:tid1904553][client37.228.129.241:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"miotrentino.it\"][uri\"/dump.sql\"][unique_id\"ahlKc5uEvVKG5CLrKSIK5AAAAIQ\"]\,referer:miotrentino.it/dump.sql
show less
Port Scan
Brute-Force
Web App Attack
🇩🇪
IVski
2026-05-27 19:25:11
(1 week ago)
IVski WAF | Suspicious activity detected - generic bot or scanner pattern
Port Scan
Brute-Force
Web App Attack
🇩🇪
LRob.fr
2026-05-27 11:15:30
(1 week ago)
Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk- ...
show more
Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk-login jail
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-26 12:23:45
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 37.228.129.241 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 37.228.129.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 08:23:39.643835 2026] [security2:error] [pid 24137:tid 24137] [client 37.228.129.241:38728] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||dennisangellismusic.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dennisangellismusic.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahWQyygl_XAF32bCmTWnNQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
