🇺🇸
TPI-Abuse
2026-06-18 03:09:41
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 103.235.78.3 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 103.235.78.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 23:09:38.031785 2026] [security2:error] [pid 31581:tid 31581] [client 103.235.78.3:18154] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bikinitweets.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bikinitweets.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajNhchLi5TbKVXh4sAJS-gAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Bedios GmbH
2026-06-18 01:37:50
(2 days ago)
Wordpress hacking attempt
Web App Attack
🇺🇸
TPI-Abuse
2026-06-18 01:20:20
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 103.235.78.3 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 103.235.78.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 21:20:17.517871 2026] [security2:error] [pid 20612:tid 20612] [client 103.235.78.3:18271] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||airdriedrivingschool.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "airdriedrivingschool.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajNH0VLWdfmZmGKqt8IMxQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-18 00:14:36
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 103.235.78.3 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 103.235.78.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 20:14:28.618253 2026] [security2:error] [pid 5712:tid 5712] [client 103.235.78.3:18935] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||415test.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "415test.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajM4ZL74_TSHBKWN2aKndgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-06-17 17:59:19
(2 days ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
PK/Pakistan/-
Web App Attack
🇦🇺
screwlooseit.com.au
2026-06-16 00:28:55
(4 days ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
PK/Pakistan/-
Web App Attack
🇳🇱
wlt-blocker
2026-06-15 22:14:19
(4 days ago)
Unauthorized access to webpage admin
Web App Attack
🇫🇷
dynamix
2026-06-15 18:46:45
(4 days ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇫🇷
YF
2026-06-15 14:30:40
(4 days ago)
xmlrpc.php Potential DDoS or brute force
DDoS Attack
Brute-Force
🇺🇸
TPI-Abuse
2026-06-15 09:31:15
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 103.235.78.3 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 103.235.78.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 05:31:09.641682 2026] [security2:error] [pid 17040:tid 17040] [client 103.235.78.3:17406] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||peterndudar.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "peterndudar.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai_GXQF0GCHGULPl8JCy5AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
yvoictra
2026-06-13 23:29:53
(6 days ago)
103.235.78.3 - - [14/Jun/2026:01:25:49 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 ( ...
show more
103.235.78.3 - - [14/Jun/2026:01:25:49 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/89.0.0.0 Safari/537.36"
103.235.78.3 - - [14/Jun/2026:01:28:07 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/80.0.0.0 Safari/537.36"
103.235.78.3 - - [14/Jun/2026:01:28:35 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/80.0.0.0 Safari/537.36"
103.235.78.3 - - [14/Jun/2026:01:29:01 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/70.0.0.0 Safari/537.36"
103.235.78.3 - - [14/Jun/2026:01:29:28 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/79.0.0.0 Safari/537.36"
103.235.78
...
show less
Brute-Force
Web App Attack