🇺🇸
kosada.com
2026-08-26 09:34:44
(2 weeks ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-11 15:20:49
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 11:20:45.244212 2026] [security2:error] [pid 2465573:tid 2465690] [client 45.118.166.184:55492] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 45.118.166.184 (+1 hits since last alert)|pilargarciamanzanares.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pilargarciamanzanares.com"] [uri "/xmlrpc.php"] [unique_id "ans9zS4Bxz7hoMKvFaiOCwAAAkI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-08-11 14:06:54
(1 month ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-08-11 13:49:17
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 09:49:11.194874 2026] [security2:error] [pid 7304:tid 7304] [client 45.118.166.184:59165] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 45.118.166.184 (+1 hits since last alert)|handankoc.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "handankoc.net"] [uri "/xmlrpc.php"] [unique_id "ansoV_4fHS7c33WH7VwIWwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-08-11 13:46:23
(1 month ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-11 13:19:47
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 09:19:43.591980 2026] [security2:error] [pid 2272527:tid 2272527] [client 45.118.166.184:55970] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 45.118.166.184 (+1 hits since last alert)|iconbizpromo.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "iconbizpromo.com"] [uri "/xmlrpc.php"] [unique_id "anshb9R7rq-DtU6MjlzrhAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
IndigoRidge
2026-08-11 10:10:59
(1 month ago)
45.118.166.184 - - [11/Aug/2026:06:09:55 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5513 "-" "WordPress. ...
show more
45.118.166.184 - - [11/Aug/2026:06:09:55 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5513 "-" "WordPress.com; https://wordpress.com"
45.118.166.184 - - [11/Aug/2026:06:10:16 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5529 "-" "WordPress.com; https://wordpress.com"
45.118.166.184 - - [11/Aug/2026:06:10:27 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5513 "-" "WordPress.com; https://wordpress.com"
45.118.166.184 - - [11/Aug/2026:06:10:48 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5529 "-" "WordPress.com; https://wordpress.com"
45.118.166.184 - - [11/Aug/2026:06:10:59 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5529 "-" "WordPress.com; https://wordpress.com"
...
show less
Web App Attack
🇺🇸
mnsf
2026-08-11 10:05:16
(1 month ago)
Xmlrpc Caught (7)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-11 06:01:47
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 02:01:42.827336 2026] [security2:error] [pid 3794766:tid 3794766] [client 45.118.166.184:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 45.118.166.184 (+1 hits since last alert)|southernbroadcast.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "southernbroadcast.com"] [uri "/xmlrpc.php"] [unique_id "anq6xh4BG46Mrhj2YesFPQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-11 05:24:10
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 01:24:02.408975 2026] [security2:error] [pid 300397:tid 300397] [client 45.118.166.184:57646] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||newmooncafe.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "newmooncafe.com"] [uri "/wp-json/wp/v2/users"] [unique_id "anqx8oWBX-PmIhKTMdj24gAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-11 03:55:27
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 23:55:23.338561 2026] [security2:error] [pid 227783:tid 227783] [client 45.118.166.184:56670] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lajoze.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lajoze.com"] [uri "/wp-json/wp/v2/users"] [unique_id "anqdK91sHilZp6bmxiPQoAAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-11 02:21:44
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 45.118.166.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 22:21:39.590084 2026] [security2:error] [pid 19150:tid 19162] [client 45.118.166.184:56480] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||dbestcarting.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dbestcarting.com"] [uri "/wp-json/wp/v2/users"] [unique_id "anqHM5fGy1XCc94cRnsLIQAAAMo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-07-24 18:31:14
(1 month ago)
HTTP application-layer DoS / botnet traffic from 45.118.166.184: repeated high-cost dynamic page and ...
show more
HTTP application-layer DoS / botnet traffic from 45.118.166.184: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
show less
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
kosada.com
2026-06-29 15:02:10
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
2026-05-05 06:52:13
(4 months ago)
Unauthorized connection attempt on Port 2323
Port Scan
Hacking
Exploited Host