🇩🇪
ger-stg-sifi1
2026-06-18 18:38:01
(4 days ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-06-18 18:13:10
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 14:13:02.727320 2026] [security2:error] [pid 6665:tid 6665] [client 37.61.122.108:9393] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.61.122.108 (+1 hits since last alert)|dennisangellismusic.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "dennisangellismusic.com"] [uri "/xmlrpc.php"] [unique_id "ajQ1LvEQeK-0sPofhuxjYwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-18 15:42:13
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 11:42:09.738303 2026] [security2:error] [pid 25305:tid 25305] [client 37.61.122.108:11023] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.61.122.108 (+1 hits since last alert)|innovacionesnimba.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "innovacionesnimba.com"] [uri "/xmlrpc.php"] [unique_id "ajQR0WO1flaufMT3BU6GLwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-06-18 15:34:20
(5 days ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-18 09:07:43
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 05:07:36.623854 2026] [security2:error] [pid 32322:tid 32322] [client 37.61.122.108:9677] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.61.122.108 (+1 hits since last alert)|4115thewestford.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "4115thewestford.com"] [uri "/xmlrpc.php"] [unique_id "ajO1WPt_L7iLUrJVH_YoVgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-18 05:23:36
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 01:23:30.224656 2026] [security2:error] [pid 26475:tid 26475] [client 37.61.122.108:9596] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.61.122.108 (+1 hits since last alert)|high5-vr.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "high5-vr.com"] [uri "/xmlrpc.php"] [unique_id "ajOA0oOrzB4lPdoZ_PWMuQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
EGP Abuse Dept
2026-06-18 05:00:08
(5 days ago)
Scanning for port/service exploits on tpc-027.mach3builders.nl
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-06-18 03:25:18
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 23:25:12.481368 2026] [security2:error] [pid 308:tid 308] [client 37.61.122.108:6313] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.61.122.108 (+1 hits since last alert)|iconbizpromo.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "iconbizpromo.com"] [uri "/xmlrpc.php"] [unique_id "ajNlGHbMSluDDMpOkC1-4QAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-17 23:42:36
(5 days ago)
[redacted] 37.61.122.108 - - [18/Jun/2026:01:41:30 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "J ...
show more
[redacted] 37.61.122.108 - - [18/Jun/2026:01:41:30 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.2)"
[redacted] 37.61.122.108 - - [18/Jun/2026:01:41:40 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 37.61.122.108 - - [18/Jun/2026:01:41:51 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 37.61.122.108 - - [18/Jun/2026:01:42:22 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)"
[redacted] 37.61.122.108 - - [18/Jun/2026:01:42:33 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.5; WordPress/6.4; http://site43752043.com"
...
show less
Hacking
Web App Attack
🇦🇹
urnilxfgbez
2026-05-28 22:45:00
(3 weeks ago)
Last 24 Hours suspicious: (DPT=445|DPT=3389|DPT=22|DPT=3306|DPT=8080|DPT=23|DPT=5900|DPT=1433)
Port Scan
🇬🇧
PeravixGroup
2026-05-27 13:36:19
(3 weeks ago)
Honeypot detection: Telnet / IoT device brute-force or exploitation attempt on port 23. Severity: ME ...
show more
Honeypot detection: Telnet / IoT device brute-force or exploitation attempt on port 23. Severity: MEDIUM. Aaran.cloud
show less
IoT Targeted
Brute-Force
🇺🇸
TPI-Abuse
2026-03-29 21:09:31
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 17:09:24.470373 2026] [security2:error] [pid 6687:tid 6687] [client 37.61.122.108:6139] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.et.lobibilisim.com"] [uri "/vendor/league/commonmark/composer.json"] [unique_id "acmVBJ885GZjCBaYYE4FRQAAABY"], referer: https://www.et.lobibilisim.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-10-03 06:17:05
(1 year ago)
| CMS (WordPress or Joomla) brute force attempt 10 times (rewritten)
Hacking
SQL Injection
Web App Attack
🇺🇸
TPI-Abuse
2024-09-28 16:18:12
(1 year ago)
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 28 12:18:06.890315 2024] [security2:error] [pid 4045:tid 4045] [client 37.61.122.108:14762] [client 37.61.122.108] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.61.122.108 (+1 hits since last alert)|asapsmogcheck.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "asapsmogcheck.com"] [uri "/xmlrpc.php"] [unique_id "ZvgsPnHOT2uXaAPq7pBNmQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-09-28 06:28:46
(1 year ago)
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 37.61.122.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 28 02:28:39.363559 2024] [security2:error] [pid 19144:tid 19144] [client 37.61.122.108:11487] [client 37.61.122.108] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.61.122.108 (+1 hits since last alert)|www.uphillfarmvt.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.uphillfarmvt.com"] [uri "/xmlrpc.php"] [unique_id "ZveiF8ziKdV5XturOyG_LQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack