🇺🇸
Lee Daniel
2026-08-21 10:56:34
(5 minutes ago)
[21/Aug/2026:06:55:50.821304 --0400] aogutptBXP-t-77eYH58gwAAAQE 37.114.149.2 39794 127.0.0.1 7081
[ ...
show more
[21/Aug/2026:06:55:50.821304 --0400] aogutptBXP-t-77eYH58gwAAAQE 37.114.149.2 39794 127.0.0.1 7081
[21/Aug/2026:06:56:01.377144 --0400] aoguwZtBXP-t-77eYH58mwAAAQI 37.114.149.2 52088 127.0.0.1 7081
[21/Aug/2026:06:56:11.914263 --0400] aoguyynI5r9xiwe6ReNLngAAABE 37.114.149.2 36418 127.0.0.1 7081
[21/Aug/2026:06:56:22.469853 --0400] aogu1vn@0F-egkXXeBEgRwAAAFc 37.114.149.2 37658 127.0.0.1 7081
[21/Aug/2026:06:56:32.990219 --0400] aogu4Pn@0F-egkXXeBEgVgAAAFM 37.114.149.2 34336 127.0.0.1 7081
...
show less
DDoS Attack
Brute-Force
🇳🇱
Site.eu
2026-08-21 10:02:10
(59 minutes ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-08-20 12:47:37
(22 hours ago)
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 08:47:31.256015 2026] [security2:error] [pid 9395:tid 9395] [client 37.114.149.2:12928] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.114.149.2 (+1 hits since last alert)|casadelsolmexico.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "casadelsolmexico.net"] [uri "/xmlrpc.php"] [unique_id "aob3YxiEhewA_AEZ3aLYawAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-20 12:14:59
(22 hours ago)
2026-08-20T12:14:38.538167+00:00 instance-20260804-1025 wordpress(expensas.co)[135891]: XML-RPC auth ...
show more
2026-08-20T12:14:38.538167+00:00 instance-20260804-1025 wordpress(expensas.co)[135891]: XML-RPC authentication failure for jmgomezp from 37.114.149.2
2026-08-20T12:14:48.756342+00:00 instance-20260804-1025 wordpress(expensas.co)[135891]: XML-RPC authentication failure for jmgomezp from 37.114.149.2
2026-08-20T12:14:59.340757+00:00 instance-20260804-1025 wordpress(expensas.co)[135419]: XML-RPC authentication failure for jmgomezp from 37.114.149.2
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-18 19:01:40
(2 days ago)
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 15:01:36.127421 2026] [security2:error] [pid 26398:tid 26398] [client 37.114.149.2:16950] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.114.149.2 (+1 hits since last alert)|pixelspective.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pixelspective.com"] [uri "/xmlrpc.php"] [unique_id "aoSsEEsC0lSiUBNvJIwuFgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-18 18:02:18
(2 days ago)
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 14:02:14.801533 2026] [security2:error] [pid 24211:tid 24211] [client 37.114.149.2:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.114.149.2 (+1 hits since last alert)|pixacast.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pixacast.com"] [uri "/xmlrpc.php"] [unique_id "aoSeJvYnfcZyAZJP8Ge1CQAAADc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-18 00:49:26
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 20:49:18.864374 2026] [security2:error] [pid 25357:tid 25357] [client 37.114.149.2:4134] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.114.149.2 (+1 hits since last alert)|pathpa.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pathpa.org"] [uri "/xmlrpc.php"] [unique_id "aoOsDhN4XXJSgFvcbT2-ygAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
ycoskun41
2026-08-17 12:51:27
(3 days ago)
fail2ban: plesk-modsecurity jail on genckocaeli.com
Web App Attack
🇺🇸
TPI-Abuse
2026-08-16 22:18:51
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 18:18:45.421533 2026] [security2:error] [pid 1225897:tid 1225897] [client 37.114.149.2:9730] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.114.149.2 (+1 hits since last alert)|nearfieldchrist.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nearfieldchrist.com"] [uri "/xmlrpc.php"] [unique_id "aoI3Rd_cD3xsq48fG4J0CgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-08-16 13:13:08
(4 days ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-08-14 06:51:10
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 02:51:06.757517 2026] [security2:error] [pid 1144756:tid 1144756] [client 37.114.149.2:11912] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.114.149.2 (+1 hits since last alert)|se-advisorsgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "se-advisorsgroup.com"] [uri "/xmlrpc.php"] [unique_id "an662vQ_DTiB-aw7azW_iAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-13 20:39:36
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 16:39:28.963247 2026] [security2:error] [pid 32187:tid 32187] [client 37.114.149.2:1697] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.114.149.2 (+1 hits since last alert)|peterndudar.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "peterndudar.com"] [uri "/xmlrpc.php"] [unique_id "an4rgFdjApDGbFVOKv3MiwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-13 16:04:11
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 12:04:07.778644 2026] [security2:error] [pid 2628611:tid 2628628] [client 37.114.149.2:1788] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.114.149.2 (+1 hits since last alert)|georgementz.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "georgementz.org"] [uri "/xmlrpc.php"] [unique_id "an3q9wkXr38qLOArIi28sAAAAIM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-13 09:26:02
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 37.114.149.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 05:25:57.540631 2026] [security2:error] [pid 28691:tid 28801] [client 37.114.149.2:12791] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 37.114.149.2 (+1 hits since last alert)|trulyoriginalpurpleoctopus.art|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "trulyoriginalpurpleoctopus.art"] [uri "/xmlrpc.php"] [unique_id "an2NpXSYBh6VS7K39NSqxwAAAQ0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
bigwavedave
2026-08-13 09:21:28
(1 week ago)
Wordpress Attack
Web App Attack