🇫🇮
bittiguru.fi
2025-11-04 05:41:05
(7 months ago)
115.98.150.203 - [04/Nov/2025:07:39:39 +0200] "POST /xmlrpc.php HTTP/1.1" 404 24608 "-" "Mozilla/5.0 ...
show more
115.98.150.203 - [04/Nov/2025:07:39:39 +0200] "POST /xmlrpc.php HTTP/1.1" 404 24608 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/67.0.0.0 Safari/537.36" "-"
115.98.150.203 - [04/Nov/2025:07:41:04 +0200] "POST /xmlrpc.php HTTP/1.1" 404 24608 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/77.0.0.0 Safari/537.36" "-"
...
show less
Hacking
Brute-Force
Web App Attack
🇩🇪
kjaerulff
2025-11-04 04:57:31
(7 months ago)
Failed Wordpress login using xmlrpc.php (150.98.115.203.hathway.com)
Web App Attack
2025-11-04 04:40:49
(7 months ago)
(wordpress) Failed wordpress login from 115.98.150.203 (IN/India/150.98.115.203.hathway.com)
Brute-Force
🇺🇸
TPI-Abuse
2025-11-04 04:35:54
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 115.98.150.203 (150.98.115.203.hathway.com): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 115.98.150.203 (150.98.115.203.hathway.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 03 23:35:48.022958 2025] [security2:error] [pid 9374:tid 9374] [client 115.98.150.203:58574] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||eliteelectricalservices.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "eliteelectricalservices.us"] [uri "/wp-json/wp/v2/users"] [unique_id "aQmCpPuLokX0-t1jYEe1KgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
maxxsense
2025-11-04 03:57:46
(7 months ago)
(wordpress) Failed wordpress login from 115.98.150.203 (IN/India/150.98.115.203.hathway.com)
Brute-Force
🇺🇸
TPI-Abuse
2025-11-03 16:43:42
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 115.98.150.203 (150.98.115.203.hathway.com): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 115.98.150.203 (150.98.115.203.hathway.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 03 11:43:34.336541 2025] [security2:error] [pid 2337:tid 2337] [client 115.98.150.203:64524] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||btccasting.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "btccasting.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aQjbtthbIeE3dB9X1nbm4QAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-03 11:06:54
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 115.98.150.203 (150.98.115.203.hathway.com): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 115.98.150.203 (150.98.115.203.hathway.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 03 06:06:45.864964 2025] [security2:error] [pid 21583:tid 21583] [client 115.98.150.203:52720] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||spacebooger.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "spacebooger.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aQiMxfVyJlXV8ZwNx4JPGgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
artificialred.nl
2025-11-03 04:52:01
(7 months ago)
[XMLRPC probing] access_ssl_log:115.98.150.203 - - [03/Nov/2025:05:51:29 +0100] GET /xmlrpc.php HTTP ...
show more
[XMLRPC probing] access_ssl_log:115.98.150.203 - - [03/Nov/2025:05:51:29 +0100] GET /xmlrpc.php HTTP/1.0" 301 3848 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML
show less
Web App Attack
2025-11-02 09:47:02
(7 months ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-11-01 17:13:29
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 115.98.150.203 (150.98.115.203.hathway.com): 1 ...
show more
(mod_security) mod_security (id:225170) triggered by 115.98.150.203 (150.98.115.203.hathway.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 01 13:13:22.244835 2025] [security2:error] [pid 29289:tid 29301] [client 115.98.150.203:56489] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||tomithai.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tomithai.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aQY_sn3ZxI0nlMe2_W6JQwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2025-11-01 15:36:37
(7 months ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
IN/India/150.98.115.203.hathway.com
Web App Attack
🇩🇪
findlab
2025-11-01 12:20:02
(7 months ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇨🇭
teamsecure
2025-11-01 10:24:30
(7 months ago)
Banned for trying to access xmlrpc
Web App Attack
2025-11-01 10:09:21
(7 months ago)
XMLRPC Hack Attempts
Hacking
Brute-Force
🇩🇪
stinpriza
2025-11-01 07:18:15
(7 months ago)
Web App Attack
Web App Attack