🇺🇸
TPI-Abuse
2026-08-25 05:49:55
(2 hours ago)
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 01:49:49.848831 2026] [security2:error] [pid 25481:tid 25481] [client 37.242.94.76:10028] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.242.94.76 (+1 hits since last alert)|athletefirst.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "athletefirst.org"] [uri "/xmlrpc.php"] [unique_id "ao0s_Qs_8gXDqJOlIvW1_gAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 04:49:13
(3 hours ago)
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 00:49:05.458418 2026] [security2:error] [pid 11361:tid 11449] [client 37.242.94.76:10863] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.242.94.76 (+1 hits since last alert)|utahhoaservices.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "utahhoaservices.com"] [uri "/xmlrpc.php"] [unique_id "ao0ewcQOcZG4u7zMG6upfQAAAUc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 02:07:14
(5 hours ago)
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 22:07:09.963442 2026] [security2:error] [pid 13007:tid 13015] [client 37.242.94.76:9458] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.242.94.76 (+1 hits since last alert)|whitecrosslibrary.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "whitecrosslibrary.com"] [uri "/xmlrpc.php"] [unique_id "aoz4zUWSRb6X5rF3Gg7JkwAAAIY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-25 00:29:36
(7 hours ago)
[redacted] 37.242.94.76 - - [25/Aug/2026:02:28:52 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Je ...
show more
[redacted] 37.242.94.76 - - [25/Aug/2026:02:28:52 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.0; WordPress/6.4; http://site72317443.com"
[redacted] 37.242.94.76 - - [25/Aug/2026:02:29:03 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2)"
[redacted] 37.242.94.76 - - [25/Aug/2026:02:29:14 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/13.0; WordPress/6.3; http://site10104729.com"
[redacted] 37.242.94.76 - - [25/Aug/2026:02:29:24 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 37.242.94.76 - - [25/Aug/2026:02:29:36 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.1; WordPress/6.1; http://site95992297.com"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-24 21:46:55
(10 hours ago)
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 17:46:48.703329 2026] [security2:error] [pid 9868:tid 9868] [client 37.242.94.76:10083] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.242.94.76 (+1 hits since last alert)|marklex.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "marklex.com"] [uri "/xmlrpc.php"] [unique_id "aoy7yGLdEX6fd8bgs7VvXQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-24 17:44:41
(14 hours ago)
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 13:44:36.388672 2026] [security2:error] [pid 25283:tid 25283] [client 37.242.94.76:12832] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.242.94.76 (+1 hits since last alert)|jessicalevant.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jessicalevant.com"] [uri "/xmlrpc.php"] [unique_id "aoyDBFJbgpNkX5VIJmSuagAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
YF
2026-08-24 15:00:24
(16 hours ago)
Distributed subnet attack — coordinated scanning from multiple IPs in the same /24
DDoS Attack
Web App Attack
🇩🇪
konseptit
2026-08-24 07:09:21
(1 day ago)
(wordpress) Failed wordpress login from 37.242.94.76 (SA/Saudi Arabia/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-08-24 05:40:56
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 01:40:48.585802 2026] [security2:error] [pid 10041:tid 10041] [client 37.242.94.76:10529] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.242.94.76 (+1 hits since last alert)|kairoslogammakmur.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kairoslogammakmur.com"] [uri "/xmlrpc.php"] [unique_id "aovZYCjNXfN5nYPE8vVMfwAAAEs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-08-24 01:32:44
(1 day ago)
4.275 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot
2026-08-23 21:22:06
(1 day ago)
[redacted] 37.242.94.76 - - [23/Aug/2026:23:21:23 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Wo ...
show more
[redacted] 37.242.94.76 - - [23/Aug/2026:23:21:23 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 37.242.94.76 - - [23/Aug/2026:23:21:34 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 37.242.94.76 - - [23/Aug/2026:23:21:44 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.5; WordPress/6.1; http://site29772816.com"
[redacted] 37.242.94.76 - - [23/Aug/2026:23:21:56 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 37.242.94.76 - - [23/Aug/2026:23:22:06 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.2)"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 19:24:08
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 15:24:04.614373 2026] [security2:error] [pid 25330:tid 25330] [client 37.242.94.76:15099] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.242.94.76 (+1 hits since last alert)|phalanxemail.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "phalanxemail.net"] [uri "/xmlrpc.php"] [unique_id "aotI1OW6FiYxEOghIFA26wAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Marc
2026-08-23 10:38:24
(1 day ago)
37.242.94.76 - - [23/Aug/2026:12:38:02 +0200] "POST /xmlrpc.php HTTP/1.1" 403 4841 "-" "WordPress.co ...
show more
37.242.94.76 - - [23/Aug/2026:12:38:02 +0200] "POST /xmlrpc.php HTTP/1.1" 403 4841 "-" "WordPress.com; https://wordpress.com" 37.242.94.76 - - [23/Aug/2026:12:38:14 +0200] "POST /xmlrpc.php HTTP/1.1" 403 4840 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.1)" 37.242.94.76 - - [23/Aug/2026:12:38:23 +0200] "POST /xmlrpc.php HTTP/1.1" 403 4841 "-" "Jetpack/13.0; WordPress/6.4; http://site41639421.com"
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 08:50:15
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 04:50:07.744720 2026] [security2:error] [pid 6640:tid 6640] [client 37.242.94.76:16456] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.242.94.76 (+1 hits since last alert)|j3pr.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "j3pr.com"] [uri "/xmlrpc.php"] [unique_id "aoq0P6_QVCUeAQkXVxtzlwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 03:34:12
(2 days ago)
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.242.94.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 23:34:07.363001 2026] [security2:error] [pid 12177:tid 12177] [client 37.242.94.76:16563] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.242.94.76 (+1 hits since last alert)|appalachianfieldstofamilies.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "appalachianfieldstofamilies.org"] [uri "/xmlrpc.php"] [unique_id "aopqL6VlggPP6QgVHCdIdwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack