🇫🇷
tecnicorioja
2026-06-28 22:00:38
(5 hours ago)
POST /xmlrpc.php [28/Jun/2026:04:31:53
Brute-Force
Web App Attack
🇳🇱
ConsulHosting
2026-06-28 08:18:05
(18 hours ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇺🇸
TPI-Abuse
2026-06-28 08:02:51
(18 hours ago)
(mod_security) mod_security (id:240335) triggered by 103.151.227.146 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 103.151.227.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 04:02:45.128311 2026] [security2:error] [pid 27760:tid 27760] [client 103.151.227.146:50266] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.151.227.146 (+1 hits since last alert)|forerunnersjazz.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "forerunnersjazz.org"] [uri "/xmlrpc.php"] [unique_id "akDVJamVlVD-nxtZHL7UhgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-28 03:58:39
(23 hours ago)
(mod_security) mod_security (id:240335) triggered by 103.151.227.146 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 103.151.227.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 23:58:32.414472 2026] [security2:error] [pid 11434:tid 11446] [client 103.151.227.146:65423] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.151.227.146 (+1 hits since last alert)|abusaimeh.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "abusaimeh.com"] [uri "/xmlrpc.php"] [unique_id "akCb6E4-pKBHl1384PyDeAAAAMo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-28 02:53:31
(1 day ago)
103.151.227.146 - - [28/Jun/2026:04:52:49 +0200] "POST /xmlrpc.php HTTP/1.1" 200 767 "-" "Jetpack by ...
show more
103.151.227.146 - - [28/Jun/2026:04:52:49 +0200] "POST /xmlrpc.php HTTP/1.1" 200 767 "-" "Jetpack by WordPress.com"
103.151.227.146 - - [28/Jun/2026:04:52:59 +0200] "POST /xmlrpc.php HTTP/1.1" 200 767 "-" "Jetpack/12.0; WordPress/6.2; http://site16210730.com"
103.151.227.146 - - [28/Jun/2026:04:53:09 +0200] "POST /xmlrpc.php HTTP/1.1" 200 767 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.2)"
103.151.227.146 - - [28/Jun/2026:04:53:20 +0200] "POST /xmlrpc.php HTTP/1.1" 200 767 "-" "WordPress.com; https://wordpress.com"
103.151.227.146 - - [28/Jun/2026:04:53:30 +0200] "POST /xmlrpc.php HTTP/1.1" 200 767 "-" "WordPress.com; https://wordpress.com"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-28 00:52:48
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 103.151.227.146 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 103.151.227.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 20:52:33.291648 2026] [security2:error] [pid 23695:tid 23695] [client 103.151.227.146:50034] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.151.227.146 (+1 hits since last alert)|theamarals.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "theamarals.com"] [uri "/xmlrpc.php"] [unique_id "akBwUSa3fZ7TeIFKz8JgSAAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-27 06:26:37
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 103.151.227.146 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 103.151.227.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 02:26:30.567590 2026] [security2:error] [pid 5989:tid 5997] [client 103.151.227.146:50261] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.151.227.146 (+1 hits since last alert)|quantumgaze.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "quantumgaze.com"] [uri "/xmlrpc.php"] [unique_id "aj9tFld33PTd9JzDVPrNbwAAAQY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2026-06-27 05:23:55
(1 day ago)
Multiple WAF Violations
Brute-Force
Web App Attack
2026-06-27 03:15:16
(1 day ago)
[ssd5.kdns.gr] httpd-xmlrpc-post: sites=electromecanica.gr; logs=/var/log/httpd/domains/electromecan ...
show more
[ssd5.kdns.gr] httpd-xmlrpc-post: sites=electromecanica.gr; logs=/var/log/httpd/domains/electromecanica.gr.log; samples=/xmlrpc.php
show less
Brute-Force
Web App Attack
🇦🇺
screwlooseit.com.au
2026-06-27 01:06:36
(2 days ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
-
Web App Attack
🇫🇷
dynamix
2026-06-21 07:35:49
(1 week ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
2026-05-26 03:14:13
(1 month ago)
Attac
Brute-Force
🇧🇪
cmbplf
2026-05-23 06:25:37
(1 month ago)
2.039 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot
2026-05-22 23:50:23
(1 month ago)
Attac
Brute-Force
2026-05-21 00:33:17
(1 month ago)
Attac
Brute-Force