🇩🇪
ghostwarriors
2026-08-22 23:21:10
(5 days ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-08-22 23:09:41
(5 days ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-08-22 21:01:27
(6 days ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
PK/Pakistan/-
Web App Attack
🇺🇸
IndigoRidge
2026-08-22 20:43:16
(6 days ago)
39.38.113.90 - - [22/Aug/2026:16:41:47 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5122 "-" "WordPress.co ...
show more
39.38.113.90 - - [22/Aug/2026:16:41:47 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5122 "-" "WordPress.com; https://wordpress.com"
39.38.113.90 - - [22/Aug/2026:16:41:58 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5122 "-" "WordPress.com; https://wordpress.com"
39.38.113.90 - - [22/Aug/2026:16:42:52 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5122 "-" "WordPress.com; https://wordpress.com"
39.38.113.90 - - [22/Aug/2026:16:43:03 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5122 "-" "WordPress.com; https://wordpress.com"
39.38.113.90 - - [22/Aug/2026:16:43:14 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5122 "-" "WordPress.com; https://wordpress.com"
...
show less
Web App Attack
🇹🇷
ycoskun41
2026-08-22 20:32:47
(6 days ago)
fail2ban: plesk-modsecurity jail on genckocaeli.com
Web App Attack
🇧🇪
madeit
2026-08-22 20:22:53
(6 days ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-08-22 00:46:37
(6 days ago)
(mod_security) mod_security (id:240335) triggered by 39.38.113.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 39.38.113.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 20:46:32.434181 2026] [security2:error] [pid 25183:tid 25183] [client 39.38.113.90:29265] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.38.113.90 (+1 hits since last alert)|firstunitedreserve.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "firstunitedreserve.com"] [uri "/xmlrpc.php"] [unique_id "aojxaC1KSf5FIsSA0bMx9QAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-22 00:08:23
(6 days ago)
(mod_security) mod_security (id:240335) triggered by 39.38.113.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 39.38.113.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 20:08:15.357159 2026] [security2:error] [pid 7181:tid 7181] [client 39.38.113.90:62052] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.38.113.90 (+1 hits since last alert)|iconconstructors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "iconconstructors.com"] [uri "/xmlrpc.php"] [unique_id "aojob7wh9hN_CquliCOAEAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-21 23:12:27
(6 days ago)
(mod_security) mod_security (id:240335) triggered by 39.38.113.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 39.38.113.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 19:12:21.380013 2026] [security2:error] [pid 3028:tid 3028] [client 39.38.113.90:32077] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.38.113.90 (+1 hits since last alert)|jimrichardart.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jimrichardart.com"] [uri "/xmlrpc.php"] [unique_id "aojbVVFzVaR16KmF3WjD_wAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-08-21 21:38:05
(1 week ago)
2.464 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-21 21:04:22
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 39.38.113.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 39.38.113.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 17:04:14.888260 2026] [security2:error] [pid 19485:tid 19500] [client 39.38.113.90:53120] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.38.113.90 (+1 hits since last alert)|piazza9.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "piazza9.com"] [uri "/xmlrpc.php"] [unique_id "aoi9TkIxJ3Lwd8tfPgbpvAAAAIw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-21 20:38:19
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 39.38.113.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 39.38.113.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 16:38:15.043689 2026] [security2:error] [pid 29657:tid 29657] [client 39.38.113.90:44086] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.38.113.90 (+1 hits since last alert)|oogeothermal.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "oogeothermal.com"] [uri "/xmlrpc.php"] [unique_id "aoi3N8eYiVLf7bZYmSDINQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
integrantservices.com
2026-08-21 19:51:37
(1 week ago)
(wordpress) Failed wordpress login from 39.38.113.90 (PK/Pakistan/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-08-21 18:52:39
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 39.38.113.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 39.38.113.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 14:52:33.022179 2026] [security2:error] [pid 13572:tid 13572] [client 39.38.113.90:55605] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.38.113.90 (+1 hits since last alert)|theseoscribe.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "theseoscribe.com"] [uri "/xmlrpc.php"] [unique_id "aoiecYvWm2jDTs9RZ9OWXwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ConsulHosting
2026-08-21 18:30:04
(1 week ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack