🇩🇪
pscriptos
2026-07-20 15:24:35
(3 days ago)
{"ClientAddr":"39.63.189.240:55152","ClientHost":"39.63.189.240","ClientPort":"55152","ClientUsernam ...
show more
{"ClientAddr":"39.63.189.240:55152","ClientHost":"39.63.189.240","ClientPort":"55152","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":139065560,"OriginContentSize":418,"OriginDuration":135442163,"OriginStatus":403,"Overhead":3623397,"RequestAddr":"www.cleveradmin.de","RequestContentSize":718,"RequestCount":1605863,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-07-20T17:24:14.63134876+02:00","StartUTC":"2026-07-20T15:24:14.63134876Z","TLSCipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLSVersion":"1.2","entryPointName":"websecure","level":"info","msg":"","time":"2026-07-20T17:24:14+02:00"}
{"ClientAddr":"39.63.189.240:55152","ClientHost":"39.63.189.240","Cl
...
show less
Brute-Force
Web App Attack
🇫🇷
DUBREUIL
2026-07-20 11:19:00
(3 days ago)
As always with Pakistan
/xmlrpc.php
DDoS Attack
Open Proxy
Port Scan
Brute-Force
Web App Attack
SSH
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-07-20 10:39:36
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 39.63.189.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 39.63.189.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 06:39:30.281502 2026] [security2:error] [pid 3890293:tid 3890293] [client 39.63.189.240:54121] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.63.189.240 (+1 hits since last alert)|auraffinity.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "auraffinity.com"] [uri "/xmlrpc.php"] [unique_id "al364jvzf6ZFb1UpMzJGYwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-20 07:40:22
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 39.63.189.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 39.63.189.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 03:40:11.565073 2026] [security2:error] [pid 31879:tid 31879] [client 39.63.189.240:61153] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.63.189.240 (+1 hits since last alert)|mkdesignndetailing.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "mkdesignndetailing.com"] [uri "/xmlrpc.php"] [unique_id "al3Q20_AbH2V6gzRzDwCkgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
integrantservices.com
2026-07-20 06:39:36
(4 days ago)
(wordpress) Failed wordpress login from 39.63.189.240 (PK/Pakistan/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-07-20 06:14:16
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 39.63.189.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 39.63.189.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 02:14:12.880379 2026] [security2:error] [pid 31567:tid 31567] [client 39.63.189.240:62110] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.63.189.240 (+1 hits since last alert)|jaragoodrich.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jaragoodrich.com"] [uri "/xmlrpc.php"] [unique_id "al28tPkvCc4cEemSdHIu6wAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-20 05:47:42
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 39.63.189.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 39.63.189.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 01:47:35.719629 2026] [security2:error] [pid 6828:tid 6828] [client 39.63.189.240:65124] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.63.189.240 (+1 hits since last alert)|thereisaplaceonearth.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thereisaplaceonearth.com"] [uri "/xmlrpc.php"] [unique_id "al22d7PVTL15wyt93ljEmAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-20 05:21:53
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 39.63.189.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 39.63.189.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 01:21:47.891823 2026] [security2:error] [pid 12432:tid 12432] [client 39.63.189.240:54898] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.63.189.240 (+1 hits since last alert)|celebritybikinigossip.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "celebritybikinigossip.com"] [uri "/xmlrpc.php"] [unique_id "al2wa6xgrMebJJEVNgY85wAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-07-20 05:20:37
(4 days ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
2026-07-20 05:18:39
(4 days ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack