🇫🇷
applemooz
2026-06-29 01:56:49
(35 minutes ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
🇺🇸
factor1
2026-06-28 17:06:01
(9 hours ago)
Fail2ban at churndash Reports Abuse.
Brute-Force
Web App Attack
🇺🇸
Dolphi
2026-06-28 10:40:03
(15 hours ago)
Excessive POST /xmlrpc.php requests
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-28 10:00:59
(16 hours ago)
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 06:00:54.404572 2026] [security2:error] [pid 23056:tid 23056] [client 103.191.122.13:30211] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.191.122.13 (+1 hits since last alert)|rentkase.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rentkase.com"] [uri "/xmlrpc.php"] [unique_id "akDw1gw4ks5WYfgugnI8OgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
masterguru
2026-06-28 04:07:09
(22 hours ago)
(xmlrpc) Failed xmlrpc access from 103.191.122.13 (PK/Pakistan/-): 5 in the last 3600 secs (0-122)
Hacking
🇳🇱
Site.eu
2026-06-27 11:59:43
(1 day ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-06-27 11:01:06
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 07:01:02.659904 2026] [security2:error] [pid 30083:tid 30083] [client 103.191.122.13:30594] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.191.122.13 (+1 hits since last alert)|doublenaughtspycar.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "doublenaughtspycar.com"] [uri "/xmlrpc.php"] [unique_id "aj-tbqrp7Qxc4lb6bSBawAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-27 07:57:35
(1 day ago)
[redacted] 103.191.122.13 - - [27/Jun/2026:09:56:52 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" " ...
show more
[redacted] 103.191.122.13 - - [27/Jun/2026:09:56:52 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 103.191.122.13 - - [27/Jun/2026:09:57:02 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 103.191.122.13 - - [27/Jun/2026:09:57:12 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 103.191.122.13 - - [27/Jun/2026:09:57:23 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.1)"
[redacted] 103.191.122.13 - - [27/Jun/2026:09:57:34 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.5; WordPress/6.1; http://site86659585.com"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-27 07:24:38
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 03:24:30.449397 2026] [security2:error] [pid 9925:tid 9925] [client 103.191.122.13:30723] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.191.122.13 (+1 hits since last alert)|aseguratuauto.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "aseguratuauto.com"] [uri "/xmlrpc.php"] [unique_id "aj96rqCwuSk8xreKizEFMAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-27 06:45:32
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 02:45:24.350188 2026] [security2:error] [pid 28544:tid 28560] [client 103.191.122.13:30028] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.191.122.13 (+1 hits since last alert)|rubenluis.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rubenluis.com"] [uri "/xmlrpc.php"] [unique_id "aj9xhNCCAVQ270VTDYJpGgAAAEU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 11:52:38
(2 days ago)
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 07:52:31.918600 2026] [security2:error] [pid 22364:tid 22364] [client 103.191.122.13:30580] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.191.122.13 (+1 hits since last alert)|jeanniemorrislaw.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jeanniemorrislaw.com"] [uri "/xmlrpc.php"] [unique_id "aj5n_-yrRG5PUxr2IcfPwQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-26 09:17:37
(2 days ago)
[redacted] 103.191.122.13 - - [26/Jun/2026:11:16:54 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" " ...
show more
[redacted] 103.191.122.13 - - [26/Jun/2026:11:16:54 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.4)"
[redacted] 103.191.122.13 - - [26/Jun/2026:11:17:04 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 103.191.122.13 - - [26/Jun/2026:11:17:15 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 103.191.122.13 - - [26/Jun/2026:11:17:25 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 103.191.122.13 - - [26/Jun/2026:11:17:36 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 14:20:37
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 10:20:31.820015 2026] [security2:error] [pid 3920:tid 3920] [client 103.191.122.13:30998] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.191.122.13 (+1 hits since last alert)|versallis.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "versallis.com"] [uri "/xmlrpc.php"] [unique_id "aj05L2UoB-nYpPpZxPu9OwAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-06-25 09:28:26
(3 days ago)
xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)
Hacking
🇺🇸
TPI-Abuse
2026-06-25 09:01:25
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.191.122.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 05:01:20.658924 2026] [security2:error] [pid 17456:tid 17479] [client 103.191.122.13:30897] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.191.122.13 (+1 hits since last alert)|cynosurelandscapers.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "cynosurelandscapers.com"] [uri "/xmlrpc.php"] [unique_id "ajzuYETTwZuoU-wSrANyrgAAAFM"]
show less
Brute-Force
Bad Web Bot
Web App Attack