🇫🇷
masterguru
2026-06-19 23:19:50
(57 minutes ago)
xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)
Hacking
🇳🇱
ConsulHosting
2026-06-19 22:35:01
(1 hour ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇺🇸
TPI-Abuse
2026-06-19 21:19:17
(2 hours ago)
(mod_security) mod_security (id:225170) triggered by 103.138.223.163 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 103.138.223.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 17:19:13.389800 2026] [security2:error] [pid 31279:tid 31279] [client 103.138.223.163:18153] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||deborahbein.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "deborahbein.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajWyURINCaAjaiySbXPYEwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-06-19 19:00:06
(5 hours ago)
IM360 WAF: Rate limit exceeded for XMLRPC DoS
Web App Attack
🇱🇻
garmtech.com
2026-06-19 18:58:31
(5 hours ago)
IM360 WAF: Rate limit exceeded for XMLRPC DoS (fault code)
Web App Attack
🇺🇸
TPI-Abuse
2026-06-19 17:03:57
(7 hours ago)
(mod_security) mod_security (id:240335) triggered by 103.138.223.163 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 103.138.223.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 13:03:51.052795 2026] [security2:error] [pid 6117:tid 6117] [client 103.138.223.163:57684] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.138.223.163 (+1 hits since last alert)|goseethenurse.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "goseethenurse.com"] [uri "/xmlrpc.php"] [unique_id "ajV2d09K0tT2S11FNfYxQQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-05-02 06:45:58
(1 month ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇫🇮
YF
2026-05-02 05:01:20
(1 month ago)
xmlrpc.php Potential DDoS or brute force
DDoS Attack
Brute-Force
🇺🇸
xmission.com
2026-05-01 16:05:58
(1 month ago)
103.138.223.163 - - [01/May/2026:10:05:57 -0600] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "Jetpack/13 ...
show more
103.138.223.163 - - [01/May/2026:10:05:57 -0600] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "Jetpack/13.0; WordPress/6.3; http://site34620672.com"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-04-30 16:18:11
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 103.138.223.163 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 103.138.223.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 12:18:04.931152 2026] [security2:error] [pid 11152:tid 11152] [client 103.138.223.163:63603] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hayrun.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hayrun.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afOAvMMIf3H1fMXqkBx0gAAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-30 12:15:57
(1 month ago)
(mod_security) mod_security (id:240335) triggered by 103.138.223.163 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 103.138.223.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 08:15:51.111236 2026] [security2:error] [pid 16613:tid 16613] [client 103.138.223.163:62398] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.138.223.163 (+1 hits since last alert)|mkdesignndetailing.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "mkdesignndetailing.com"] [uri "/xmlrpc.php"] [unique_id "afNH99tI9TWSnNAXJLJBHwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-04-30 12:13:16
(1 month ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
PK/Pakistan/-
Web App Attack
🇳🇱
Site.eu
2026-04-30 10:39:00
(1 month ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
2026-04-29 11:54:10
(1 month ago)
Web App Attack, Hacking
Hacking
Web App Attack
🇳🇱
Site.eu
2026-04-29 09:49:55
(1 month ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH