🇺🇸
TPI-Abuse
2026-08-16 20:37:38
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 16:37:31.433957 2026] [security2:error] [pid 32461:tid 3 ...
show more
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 16:37:31.433957 2026] [security2:error] [pid 32461:tid 32461] [client 93.65.153.245:8091] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 93.65.153.245 (+1 hits since last alert)|davidquiroa.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "davidquiroa.com"] [uri "/xmlrpc.php"] [unique_id "aoIfiy1rEuOkyFWdfVaU7gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-16 19:25:07
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 15:25:00.012846 2026] [security2:error] [pid 11138:tid 1 ...
show more
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 15:25:00.012846 2026] [security2:error] [pid 11138:tid 11210] [client 93.65.153.245:8158] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 93.65.153.245 (+1 hits since last alert)|leadingedgesupply.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "leadingedgesupply.com"] [uri "/xmlrpc.php"] [unique_id "aoIOjLJItFBIzbZN0b6s5gAAAE4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
abivia
2026-08-16 19:16:22
UTC ·
(2 months ago)
Abivia WAF trigger: Rule staticSite: Request PHP file on a static site. uri: /xmlrpc.php
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-16 16:10:25
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 12:10:20.656312 2026] [security2:error] [pid 28756:tid 2 ...
show more
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 12:10:20.656312 2026] [security2:error] [pid 28756:tid 28756] [client 93.65.153.245:8311] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 93.65.153.245 (+1 hits since last alert)|thinkingepic.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thinkingepic.com"] [uri "/xmlrpc.php"] [unique_id "aoHg7IXJnIQazdACI2QeQwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ConsulHosting
2026-08-16 14:52:33
UTC ·
(2 months ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇧🇪
madeit
2026-08-16 14:14:51
UTC ·
(2 months ago)
Web App Attack
Anonymous
2026-08-15 18:48:27
UTC ·
(2 months ago)
fail2ban: plesk-modsecurity jail on genckocaeli.com
Web App Attack
🇺🇸
TPI-Abuse
2026-08-15 18:09:41
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 15 14:09:33.608171 2026] [security2:error] [pid 25246:tid 2 ...
show more
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 15 14:09:33.608171 2026] [security2:error] [pid 25246:tid 25246] [client 93.65.153.245:8417] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 93.65.153.245 (+1 hits since last alert)|ritterlien.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ritterlien.com"] [uri "/xmlrpc.php"] [unique_id "aoCrXTVgyi640C3qNAUXqQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-08-14 18:20:25
UTC ·
(3 months ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-08-14 18:07:06
UTC ·
(3 months ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-14 17:08:14
UTC ·
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 13:08:06.901057 2026] [security2:error] [pid 3352:tid 33 ...
show more
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 13:08:06.901057 2026] [security2:error] [pid 3352:tid 3352] [client 93.65.153.245:8480] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 93.65.153.245 (+1 hits since last alert)|jmichaelpope.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jmichaelpope.com"] [uri "/xmlrpc.php"] [unique_id "an9LdqtjB6q8Of0kLFySuQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-13 20:26:57
UTC ·
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 16:26:50.544931 2026] [security2:error] [pid 20442:tid 2 ...
show more
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 16:26:50.544931 2026] [security2:error] [pid 20442:tid 20442] [client 93.65.153.245:7805] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 93.65.153.245 (+1 hits since last alert)|laecovillage.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "laecovillage.org"] [uri "/xmlrpc.php"] [unique_id "an4oijVSqKTljHpFnSzddwAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-13 19:24:17
UTC ·
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 15:24:09.722174 2026] [security2:error] [pid 7860:tid 78 ...
show more
(mod_security) mod_security (id:240335) triggered by 93.65.153.245 (net-93-65-153-245.cust.vodafonedsl.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 15:24:09.722174 2026] [security2:error] [pid 7860:tid 7860] [client 93.65.153.245:8268] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 93.65.153.245 (+1 hits since last alert)|comicpreservation.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "comicpreservation.com"] [uri "/xmlrpc.php"] [unique_id "an4Z2SqeM2IvLVrolxqFqQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-08-13 19:21:22
UTC ·
(3 months ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.
Bad Web Bot
Web App Attack
🇳🇱
ConsulHosting
2026-08-13 18:23:51
UTC ·
(3 months ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack