🇫🇷
zkillu.fr
2026-08-19 21:36:03
(1 day ago)
UDP flood (DDoS) vs AS215599: 65413 pkts / 93.54 MB to UDP 8443 across 195 dst IP(s), 2026-08-19 21: ...
show more
UDP flood (DDoS) vs AS215599: 65413 pkts / 93.54 MB to UDP 8443 across 195 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
DDoS Attack
Exploited Host
🇫🇷
dmallet
2026-08-19 21:36:03
(1 day ago)
UDP flood (DDoS) vs AS215599: 65413 pkts / 93.54 MB to UDP 8443 across 195 dst IP(s), 2026-08-19 21: ...
show more
UDP flood (DDoS) vs AS215599: 65413 pkts / 93.54 MB to UDP 8443 across 195 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
DDoS Attack
Exploited Host
🇺🇸
TPI-Abuse
2026-08-11 09:11:47
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 05:11:42.630353 2026] [security2:error] [pid 576794:tid 576794] [client 103.153.130.32:62074] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.153.130.32 (+1 hits since last alert)|lyldevelopers.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "lyldevelopers.com"] [uri "/xmlrpc.php"] [unique_id "anrnTqjQp6uMHSnA2403GwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-08-10 08:26:36
(1 week ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-05 08:38:02
(2 weeks ago)
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 05 04:37:56.619027 2026] [security2:error] [pid 414803:tid 414803] [client 103.153.130.32:64339] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.153.130.32 (+1 hits since last alert)|joevallone.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "joevallone.com"] [uri "/xmlrpc.php"] [unique_id "anL2ZOq32ZgafLnOE-cGbwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-07-31 08:13:36
(3 weeks ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-22 15:55:15
(4 weeks ago)
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 11:55:07.153342 2026] [security2:error] [pid 1642895:tid 1642895] [client 103.153.130.32:58671] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.153.130.32 (+1 hits since last alert)|plazahacienda.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "plazahacienda.com"] [uri "/xmlrpc.php"] [unique_id "amDn2z2hzuriRLrtS7uLxgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-19 13:18:10
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 09:18:04.368091 2026] [security2:error] [pid 26959:tid 26959] [client 103.153.130.32:65089] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.153.130.32 (+1 hits since last alert)|kritaka.ai|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kritaka.ai"] [uri "/xmlrpc.php"] [unique_id "alzOjIHh0QzCVt6w603KHQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-19 10:50:12
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 06:50:05.319143 2026] [security2:error] [pid 2812154:tid 2812154] [client 103.153.130.32:53533] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.153.130.32 (+1 hits since last alert)|wild-goose.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "wild-goose.net"] [uri "/xmlrpc.php"] [unique_id "alyr3XwFXH8-yQnE69u4ZAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
DonAtari
2026-07-18 17:55:32
(1 month ago)
DShield firewall scan - TCP to port 8080
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-07-08 12:01:56
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 08:01:51.297607 2026] [security2:error] [pid 22894:tid 22894] [client 103.153.130.32:56428] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.153.130.32 (+1 hits since last alert)|stacyfarm.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "stacyfarm.com"] [uri "/xmlrpc.php"] [unique_id "ak48L8XN8cDQFPGZKCGuygAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-07-04 12:39:58
(1 month ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-xmlrpc-bf-high.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-30 14:03:04
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.153.130.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 10:02:56.891442 2026] [security2:error] [pid 19787:tid 19787] [client 103.153.130.32:56695] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.153.130.32 (+1 hits since last alert)|bennoyes.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "bennoyes.com"] [uri "/xmlrpc.php"] [unique_id "akPMkOPMni93t2QVGeOpiwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-06-29 08:54:42
(1 month ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇩🇪
konseptit
2026-06-28 11:35:28
(1 month ago)
(wordpress) Failed wordpress login from 103.153.130.32 (BD/Bangladesh/-)
Brute-Force