🇺🇸
TPI-Abuse
2026-07-24 04:40:01
(56 minutes ago)
(mod_security) mod_security (id:225170) triggered by 94.16.18.25 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 94.16.18.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 00:39:56.113194 2026] [security2:error] [pid 270979:tid 270979] [client 94.16.18.25:63712] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ronjamestelevision.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ronjamestelevision.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amLsnAsnQtQ5HAmVa-Qy0gAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-07-24 02:19:49
(3 hours ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
2026-07-23 17:59:31
(11 hours ago)
WordPress Brute Force
Brute-Force
🇺🇸
TPI-Abuse
2026-07-23 14:30:22
(15 hours ago)
(mod_security) mod_security (id:240335) triggered by 94.16.18.25 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 94.16.18.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 10:30:17.285119 2026] [security2:error] [pid 29740:tid 29740] [client 94.16.18.25:56291] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 94.16.18.25 (+1 hits since last alert)|celebritybikinigossip.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "celebritybikinigossip.com"] [uri "/xmlrpc.php"] [unique_id "amIleXTpBKSKxqgHuITCxgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
WeekendWeb
2026-07-23 13:58:06
(15 hours ago)
Wordpress Vunerability attack
Web App Attack
🇪🇸
alferez
2026-07-23 12:07:21
(17 hours ago)
xmlrpc.php attack DOS
Hacking
Exploited Host
Web App Attack
🇲🇾
Rizzy
2026-07-23 11:05:48
(18 hours ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-23 10:28:36
(19 hours ago)
(mod_security) mod_security (id:240335) triggered by 94.16.18.25 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 94.16.18.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 06:28:28.749924 2026] [security2:error] [pid 2843486:tid 2843486] [client 94.16.18.25:56906] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 94.16.18.25 (+1 hits since last alert)|evelynkay.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "evelynkay.com"] [uri "/xmlrpc.php"] [unique_id "amHszM96Q8BMzQM3hcYDTAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-23 08:54:45
(20 hours ago)
(mod_security) mod_security (id:240335) triggered by 94.16.18.25 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 94.16.18.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 04:54:38.686603 2026] [security2:error] [pid 2389757:tid 2389757] [client 94.16.18.25:57032] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 94.16.18.25 (+1 hits since last alert)|astglobaltech.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "astglobaltech.com"] [uri "/xmlrpc.php"] [unique_id "amHWzsCg9wx40p487LVa5wAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
integrantservices.com
2026-07-23 08:53:54
(20 hours ago)
(wordpress) Failed wordpress login from 94.16.18.25 (AT/Austria/-)
Brute-Force
🇨🇭
4server
2026-07-23 07:16:42
(22 hours ago)
[ThuJul2309:16:39.3553202026][security2:error][pid1919746:tid1920099][client94.16.18.25:0]ModSecurit ...
show more
[ThuJul2309:16:39.3553202026][security2:error][pid1919746:tid1920099][client94.16.18.25:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"server-privato.ch\"][uri\"/xmlrpc.php\"][unique_id\"amG_1-aYUTg9KP_JANWkPgAAAE4\"]
show less
Hacking
Web App Attack
🇱🇻
garmtech.com
2026-07-23 04:47:39
(1 day ago)
IM360 WAF: Rate limit exceeded for XMLRPC DoS
Web App Attack
🇳🇱
Site.eu
2026-07-23 00:41:32
(1 day ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-07-23 00:12:40
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 94.16.18.25 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 94.16.18.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 20:12:34.797612 2026] [security2:error] [pid 2131497:tid 2131509] [client 94.16.18.25:51370] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 94.16.18.25 (+1 hits since last alert)|sparkhypnotherapy.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "sparkhypnotherapy.com"] [uri "/xmlrpc.php"] [unique_id "amFccpmPZsGfgwZ7rrRYAgAAAIo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-22 23:40:03
(1 day ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack