🇩🇪
big-cloud.nl
2026-06-30 09:34:55
(21 hours ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-06-30 07:25:01
(23 hours ago)
(mod_security) mod_security (id:225170) triggered by 103.252.127.16 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 103.252.127.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 03:24:54.134778 2026] [security2:error] [pid 7677:tid 7677] [client 103.252.127.16:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||upskirtcrazy.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "upskirtcrazy.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akNvRvd0HH2IZlchfPxF1AAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ger-stg-sifi1
2026-06-29 09:10:32
(1 day ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇳🇱
Site.eu
2026-06-29 08:43:50
(1 day ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
2026-06-28 14:08:04
(2 days ago)
Bot / scanning and/or hacking attempts: GET /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇩🇪
rh24
2026-06-28 08:03:07
(2 days ago)
(xmlrpc_405) XMLRPC-Bot 405 103.252.127.16 (BD/Bangladesh/-)
Hacking
🇩🇪
ger-stg-sifi1
2026-06-27 10:52:26
(3 days ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇫🇷
Sklurk
2026-06-27 10:34:42
(3 days ago)
Web App Attack
Web App Attack
🇬🇧
foxxelabs
2026-06-26 04:53:37
(5 days ago)
Automated report from FoxxeLabs Sentinel. Path probed: /xmlrpc.php | Project: anseo | Reason(s): Kno ...
show more
Automated report from FoxxeLabs Sentinel. Path probed: /xmlrpc.php | Project: anseo | Reason(s): Known exploit path: /xmlrpc.php; AbuseIPDB score: 81/100 | User-Agent: Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/
show less
Web App Attack
🇩🇪
LRob.fr
2026-06-25 13:30:03
(5 days ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-06-24 08:08:00
(6 days ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇨🇭
4server
2026-06-24 06:17:14
(1 week ago)
[WedJun2408:17:07.9466662026][security2:error][pid1737252:tid1737465][client103.252.127.16:0]ModSecu ...
show more
[WedJun2408:17:07.9466662026][security2:error][pid1737252:tid1737465][client103.252.127.16:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"cpu-services.ch\"][uri\"/xmlrpc.php\"][unique_id\"ajt2Y_AokEBkDHYerU7pjgAAAMM\"]
show less
Hacking
Web App Attack
🇮🇩
Burayot
2026-06-24 05:28:15
(1 week ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 103.252.127.16 (BD/Bangladesh/-): 1 ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 103.252.127.16 (BD/Bangladesh/-): 1 in the last 3600 secs
show less
Web App Attack
🇬🇧
Bytemark
2026-06-23 12:21:05
(1 week ago)
103.252.127.16 - - [23/Jun/2026:13:20:51 +0100] "GET /xmlrpc.php HTTP/1.1" 301 5334 "-" "Mozilla/5.0 ...
show more
103.252.127.16 - - [23/Jun/2026:13:20:51 +0100] "GET /xmlrpc.php HTTP/1.1" 301 5334 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/62.0.0.0 Safari/537.36"
103.252.127.16 - - [23/Jun/2026:13:20:53 +0100] "GET /xmlrpc.php HTTP/1.1" 404 5135 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/62.0.0.0 Safari/537.36"
103.252.127.16 - - [23/Jun/2026:13:21:04 +0100] "POST /xmlrpc.php HTTP/1.1" 301 5334 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/78.0.0.0 Safari/537.36"
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-21 16:00:47
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 103.252.127.16 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 103.252.127.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 12:00:44.601644 2026] [security2:error] [pid 1571:tid 1571] [client 103.252.127.16:51835] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||peacecampus.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "peacecampus.org"] [uri "/wp-json/wp/v2/users"] [unique_id "ajgKrNRcsSmGotXefQl-zQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack