🇺🇸
TPI-Abuse
2026-07-16 17:05:18
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 13:05:10.751500 2026] [security2:error] [pid 19390:tid 19390] [client 38.17.158.68:53965] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 38.17.158.68 (+1 hits since last alert)|thepercussionworks.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thepercussionworks.com"] [uri "/xmlrpc.php"] [unique_id "alkPRt0MlAL0ziTT-hrjZwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-16 13:33:51
(2 days ago)
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 09:33:45.815840 2026] [security2:error] [pid 6488:tid 6488] [client 38.17.158.68:53159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 38.17.158.68 (+1 hits since last alert)|agrollum.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "agrollum.com"] [uri "/xmlrpc.php"] [unique_id "aljdue9yvB5vjTv2Ix51sAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
YF
2026-07-14 19:30:45
(3 days ago)
xmlrpc.php Potential DDoS or brute force
DDoS Attack
Brute-Force
🇩🇪
ghostwarriors
2026-07-14 18:20:14
(3 days ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
2026-07-14 18:05:36
(3 days ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 15:29:32
(3 weeks ago)
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 11:29:24.983645 2026] [security2:error] [pid 32708:tid 32708] [client 38.17.158.68:58637] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 38.17.158.68 (+1 hits since last alert)|nomorenicenice.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nomorenicenice.net"] [uri "/xmlrpc.php"] [unique_id "ajqmVG5TxU4KgOkXPeoD5gAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 13:58:19
(3 weeks ago)
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 09:58:11.873166 2026] [security2:error] [pid 31582:tid 31582] [client 38.17.158.68:49742] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 38.17.158.68 (+1 hits since last alert)|artevoix.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "artevoix.com"] [uri "/xmlrpc.php"] [unique_id "ajqQ85rqGRIo5Tc-yV_FxAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Marc
2026-06-22 18:05:48
(3 weeks ago)
38.17.158.68 - - [22/Jun/2026:20:05:26 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3457 "-" "Jetpack/12.1 ...
show more
38.17.158.68 - - [22/Jun/2026:20:05:26 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3457 "-" "Jetpack/12.1; WordPress/6.4; http://site52665038.com" 38.17.158.68 - - [22/Jun/2026:20:05:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3457 "-" "WordPress.com; https://wordpress.com" 38.17.158.68 - - [22/Jun/2026:20:05:47 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3456 "-" "Jetpack/12.5; WordPress/6.4; http://site60013951.com"
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 14:53:27
(3 weeks ago)
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 10:53:21.296401 2026] [security2:error] [pid 30239:tid 30239] [client 38.17.158.68:53365] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 38.17.158.68 (+1 hits since last alert)|midway-island.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "midway-island.com"] [uri "/xmlrpc.php"] [unique_id "ajlMYRVmTBxVqStli2KaMQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 13:52:49
(3 weeks ago)
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 09:52:41.862199 2026] [security2:error] [pid 8821:tid 8821] [client 38.17.158.68:57752] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 38.17.158.68 (+1 hits since last alert)|intrinsicdiscovery.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "intrinsicdiscovery.com"] [uri "/xmlrpc.php"] [unique_id "ajk-Kd5KRjGctcmAf_Q2mgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 12:22:05
(3 weeks ago)
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 08:21:59.271832 2026] [security2:error] [pid 28861:tid 28861] [client 38.17.158.68:60830] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 38.17.158.68 (+1 hits since last alert)|jonasrimkunas.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jonasrimkunas.com"] [uri "/xmlrpc.php"] [unique_id "ajko55JfraJx-PvivF8dMQAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 08:10:43
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 04:10:37.994233 2026] [security2:error] [pid 29297:tid 29297] [client 38.17.158.68:49259] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 38.17.158.68 (+1 hits since last alert)|livingminimal.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "livingminimal.com"] [uri "/xmlrpc.php"] [unique_id "ai0QfW4JxICB7hRR0OFFRQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-06-12 12:21:37
(1 month ago)
(xmlrpc) Apache: Failed xmlrpc access from 38.17.158.68 (VE/Venezuela/-): 10 in the last 3600 secs ( ...
show more
(xmlrpc) Apache: Failed xmlrpc access from 38.17.158.68 (VE/Venezuela/-): 10 in the last 3600 secs (0-201)
show less
Hacking
🇺🇸
TPI-Abuse
2026-06-08 16:35:08
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 12:35:01.192690 2026] [security2:error] [pid 19736:tid 19736] [client 38.17.158.68:53692] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 38.17.158.68 (+1 hits since last alert)|johncyphers.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "johncyphers.com"] [uri "/xmlrpc.php"] [unique_id "aibvNVb03i1WCG0M_Y3SeAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 15:42:50
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 38.17.158.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 11:42:45.252080 2026] [security2:error] [pid 1145:tid 1162] [client 38.17.158.68:64960] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 38.17.158.68 (+1 hits since last alert)|neotienda.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "neotienda.com"] [uri "/xmlrpc.php"] [unique_id "aibi9ScI-bKD8V9XlKcstwAAAE0"]
show less
Brute-Force
Bad Web Bot
Web App Attack