🇺🇸
TPI-Abuse
2026-06-19 11:17:05
(9 hours ago)
(mod_security) mod_security (id:240335) triggered by 78.25.5.220 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 78.25.5.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 07:16:59.438431 2026] [security2:error] [pid 10735:tid 10735] [client 78.25.5.220:60051] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 78.25.5.220 (+1 hits since last alert)|prcomputersolutions.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "prcomputersolutions.com"] [uri "/xmlrpc.php"] [unique_id "ajUlKxyp0cOAwhheFwlNhgAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
rh24
2026-06-19 08:43:14
(11 hours ago)
(xmlrpc_405) XMLRPC-Bot 405 78.25.5.220 (UA/Ukraine/-)
Hacking
🇫🇷
dynamix
2026-06-19 07:11:31
(13 hours ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
2026-06-19 05:54:05
(14 hours ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇩🇪
Petros Stefanakis
2026-06-17 17:53:38
(2 days ago)
(wordpress) Failed wordpress login from 78.25.5.220 (UA/Ukraine/-)
Brute-Force
2026-06-17 16:58:25
(2 days ago)
Bad Web Bot
Web App Attack
🇩🇪
rh24
2026-06-16 07:55:29
(3 days ago)
(wordpress) Failed wordpress login from 78.25.5.220 (UA/Ukraine/-): (CF_ENABLE)
Brute-Force
🇫🇷
dynamix
2026-06-16 07:54:48
(3 days ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 20:58:13
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 78.25.5.220 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 78.25.5.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 16:58:07.941444 2026] [security2:error] [pid 16006:tid 16006] [client 78.25.5.220:62960] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 78.25.5.220 (+1 hits since last alert)|vanmeer.info|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "vanmeer.info"] [uri "/xmlrpc.php"] [unique_id "ajBnX7n7QqTx6HHIaBZh4wAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-15 19:45:05
(4 days ago)
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 17:47:09
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 78.25.5.220 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 78.25.5.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 13:47:05.401032 2026] [security2:error] [pid 31180:tid 31180] [client 78.25.5.220:63732] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 78.25.5.220 (+1 hits since last alert)|verdeprofundo.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "verdeprofundo.net"] [uri "/xmlrpc.php"] [unique_id "ajA6mZdlSufVQ4OKYvy6ngAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
pscriptos
2026-06-15 15:58:08
(4 days ago)
{"ClientAddr":"78.25.5.220:63930","ClientHost":"78.25.5.220","ClientPort":"63930","ClientUsername":" ...
show more
{"ClientAddr":"78.25.5.220:63930","ClientHost":"78.25.5.220","ClientPort":"63930","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":344331142,"OriginContentSize":418,"OriginDuration":338252758,"OriginStatus":403,"Overhead":6078384,"RequestAddr":"www.cleveradmin.de","RequestContentSize":708,"RequestCount":250475,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-06-15T17:57:44.240328292+02:00","StartUTC":"2026-06-15T15:57:44.240328292Z","TLSCipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLSVersion":"1.2","entryPointName":"websecure","level":"info","msg":"","time":"2026-06-15T17:57:44+02:00"}
{"ClientAddr":"78.25.5.220:63930","ClientHost":"78.25.5.220","ClientPor
...
show less
Brute-Force
Web App Attack
🇳🇱
ConsulHosting
2026-06-14 12:29:43
(5 days ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
2026-06-14 11:41:53
(5 days ago)
[redacted] 78.25.5.220 - - [14/Jun/2026:13:41:09 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jet ...
show more
[redacted] 78.25.5.220 - - [14/Jun/2026:13:41:09 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.1)"
[redacted] 78.25.5.220 - - [14/Jun/2026:13:41:20 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 78.25.5.220 - - [14/Jun/2026:13:41:30 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2)"
[redacted] 78.25.5.220 - - [14/Jun/2026:13:41:41 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.1; WordPress/6.4; http://site89041633.com"
[redacted] 78.25.5.220 - - [14/Jun/2026:13:41:52 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 11:14:14
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 78.25.5.220 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 78.25.5.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 07:14:09.663507 2026] [security2:error] [pid 26676:tid 26676] [client 78.25.5.220:54475] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 78.25.5.220 (+1 hits since last alert)|motherlyhomecare.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "motherlyhomecare.com"] [uri "/xmlrpc.php"] [unique_id "ai6NAUf5kB1OvIz8QWhsogAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack