🇺🇸
TPI-Abuse
2026-08-14 04:06:07
(22 hours ago)
(mod_security) mod_security (id:240335) triggered by 160.191.229.115 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 160.191.229.115 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 00:06:00.304322 2026] [security2:error] [pid 2642:tid 2642] [client 160.191.229.115:53586] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 160.191.229.115 (+1 hits since last alert)|badgerkelley.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "badgerkelley.com"] [uri "/xmlrpc.php"] [unique_id "an6UKKKnUSZsVuKuqKpJ7wAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
IndigoRidge
2026-08-14 02:38:44
(23 hours ago)
160.191.229.115 - - [13/Aug/2026:22:36:19 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5545 "-" "WordPress ...
show more
160.191.229.115 - - [13/Aug/2026:22:36:19 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5545 "-" "WordPress.com; https://wordpress.com"
160.191.229.115 - - [13/Aug/2026:22:36:29 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5545 "-" "WordPress.com; https://wordpress.com"
160.191.229.115 - - [13/Aug/2026:22:37:07 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5545 "-" "WordPress.com; https://wordpress.com"
160.191.229.115 - - [13/Aug/2026:22:38:22 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5545 "-" "WordPress.com; https://wordpress.com"
160.191.229.115 - - [13/Aug/2026:22:38:43 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5545 "-" "WordPress.com; https://wordpress.com"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-12 05:59:43
(2 days ago)
(mod_security) mod_security (id:240335) triggered by 160.191.229.115 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 160.191.229.115 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 12 01:59:35.369149 2026] [security2:error] [pid 1091574:tid 1091574] [client 160.191.229.115:61361] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 160.191.229.115 (+1 hits since last alert)|greenlight.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "greenlight.us"] [uri "/xmlrpc.php"] [unique_id "anwLxw7yFmEQCjPpSD4imwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-12 03:51:27
(2 days ago)
(mod_security) mod_security (id:240335) triggered by 160.191.229.115 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 160.191.229.115 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 23:51:20.853001 2026] [security2:error] [pid 2149115:tid 2149129] [client 160.191.229.115:54435] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 160.191.229.115 (+1 hits since last alert)|tkfay.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tkfay.com"] [uri "/xmlrpc.php"] [unique_id "anvtuB1FKVcMo0HCVLFUAQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-08-12 03:22:55
(2 days ago)
WordPress login brute-force | req: /xmlrpc.php | UA: WordPress.com; https://wordpress.com
Brute-Force
Web App Attack
2026-07-29 07:00:00
(2 weeks ago)
Automated Apache web application probing in selected 24h window; attempts=17, unique_paths=1, error_ ...
show more
Automated Apache web application probing in selected 24h window; attempts=17, unique_paths=1, error_responses=0; targets include WordPress, .env/.git, phpMyAdmin, autodiscover, wpad.dat and related probe paths.
show less
Web App Attack
2026-07-29 07:00:00
(2 weeks ago)
Apache probe; attempts=17; exact paths: /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-07-29 00:40:08
(2 weeks ago)
(mod_security) mod_security (id:240335) triggered by 160.191.229.115 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 160.191.229.115 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 28 20:39:54.835555 2026] [security2:error] [pid 3188626:tid 3188626] [client 160.191.229.115:56530] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 160.191.229.115 (+1 hits since last alert)|davesievers.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "davesievers.com"] [uri "/xmlrpc.php"] [unique_id "amlL2uJLa5V4OtfSbJP2MwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-07-28 05:54:27
(2 weeks ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇩🇪
HandyTreff.de
2026-07-15 11:53:13
(4 weeks ago)
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -65.339 (Bad < -10 / Very Bad < -20 ...
show more
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -65.339 (Bad < -10 / Very Bad < -20 / Extreme < -35) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Sa
show less
Web App Attack
Bad Web Bot
🇺🇸
kosada.com
2026-07-06 20:27:52
(1 month ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
2026-07-05 08:41:42
(1 month ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
🇨🇦
polycoda
2026-05-19 10:48:33
(2 months ago)
🥶 Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27
DDoS Attack
2026-05-02 12:47:06
(3 months ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show more
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-skip.asp
show less
Exploited Host
Bad Web Bot
🇩🇪
filstal.org
2026-03-01 02:11:13
(5 months ago)
Dovecot Brute-Force: Targeted User-Enumeration (Honey-Accounts)
Email Spam
Brute-Force