🇺🇸
TPI-Abuse
2026-06-16 03:40:59
(50 minutes ago)
(mod_security) mod_security (id:240335) triggered by 98.98.21.217 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 98.98.21.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 23:40:56.202324 2026] [security2:error] [pid 23479:tid 23479] [client 98.98.21.217:60536] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 98.98.21.217 (+1 hits since last alert)|thesalonx.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thesalonx.com"] [uri "/xmlrpc.php"] [unique_id "ajDFyJrmj3zfMJtEzLmdCAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
xveil
2026-06-07 22:44:16
(1 week ago)
2026-06-08T05:44:13.529596 mail-honeypot postfix/submission/smtpd[28776]: warning: unknown[98.98.21. ...
show more
2026-06-08T05:44:13.529596 mail-honeypot postfix/submission/smtpd[28776]: warning: unknown[98.98.21.217]: SASL PLAIN authentication failed: authentication failure
...
show less
Brute-Force
🇪🇸
sshtmp
2026-05-18 09:53:03
(4 weeks ago)
[AbuseIPDB auto-report]
Attack: WordPress XML-RPC brute-force
Hits: 310 | First: 2026-05-18T00:50:38 ...
show more
[AbuseIPDB auto-report]
Attack: WordPress XML-RPC brute-force
Hits: 310 | First: 2026-05-18T00:50:38+02:00 | Last: 2026-05-18T11:53:03+02:00
Samples: POST /xmlrpc.php [200]
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-18 02:53:23
(4 weeks ago)
(mod_security) mod_security (id:240335) triggered by 98.98.21.217 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 98.98.21.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 22:53:17.266250 2026] [security2:error] [pid 26252:tid 26252] [client 98.98.21.217:56311] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 98.98.21.217 (+1 hits since last alert)|odysseydogasporlari.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "odysseydogasporlari.com"] [uri "/xmlrpc.php"] [unique_id "agp_HUyWuzyOO2BSNnIFtgAAACk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-17 23:19:05
(4 weeks ago)
(mod_security) mod_security (id:240335) triggered by 98.98.21.217 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 98.98.21.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 19:18:58.859565 2026] [security2:error] [pid 10328:tid 10328] [client 98.98.21.217:51279] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 98.98.21.217 (+1 hits since last alert)|thesalonx.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thesalonx.com"] [uri "/xmlrpc.php"] [unique_id "agpM4sFaLial5PxzuiAYxgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
[email protected]
2026-03-31 01:09:52
(2 months ago)
[Tue Mar 31 03:09:52.338141 2026] [authz_core:error] [pid 2071050:tid 2071116] [client 98.98.21.217: ...
show more
[Tue Mar 31 03:09:52.338141 2026] [authz_core:error] [pid 2071050:tid 2071116] [client 98.98.21.217:54536] AH01630: client denied by server configuration: /var/www/html/MyWeb/Wordpress_www/xmlrpc.php
...
show less
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-01-05 02:27:32
(5 months ago)
2.675 POST requests with url.path */wp-login.php
Brute-Force
Bad Web Bot
🇨🇦
polycoda
2026-01-05 02:19:36
(5 months ago)
AutoBlock: 🔐 WordPress Login Brute Force (20X or 30X) (Decay-Based)
Brute-Force
Web App Attack
🇦🇺
MAGIC
2026-01-05 02:18:47
(5 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇳🇱
Mangelot Hosting
2026-01-05 02:12:45
(5 months ago)
(wp_login_try) srv101 WP Login Attempt 98.98.21.217 (MX/Mexico/-): 10 in the last 3600 secs; Ports: ...
show more
(wp_login_try) srv101 WP Login Attempt 98.98.21.217 (MX/Mexico/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇫🇷
masterguru
2026-01-05 02:10:46
(5 months ago)
wp-login request blocked, no referer. Pattern match "wp-login.php" at REQUEST_URI. (88020-193)
Hacking
🇫🇮
Shaik Sai Meera
2026-01-05 01:55:07
(5 months ago)
IM360 WAF: Request indicates a Headless browser
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-01-05 01:55:04
(5 months ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇧🇷
KingHost
2025-12-15 22:31:14
(6 months ago)
Brute-Force
2025-12-15 22:05:03
(6 months ago)
BruteForce IMAP/POP3/SMTP
Brute-Force