2026-07-21 07:43:45
(3 days ago)
Attack report: 120.56.212.177 → TheGibson02 [2026-07-21]
Hostname: ip-172-31-17-138
Categories: 18
- ...
show more
Attack report: 120.56.212.177 → TheGibson02 [2026-07-21]
Hostname: ip-172-31-17-138
Categories: 18
--- xmlrpc abuse (150 hits) ---
120.56.212.177 - - [19/May/2026:10:43:31 +0000] "POST /xmlrpc.php HTTP/1.1" 200 3391 "-" "Jetpack/12.0; WordPress/6.1; http://site33494724.com"
120.56.212.177 - - [19/May/2026:10:43:42 +0000] "POST /xmlrpc.php HTTP/1.1" 200 3391 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.3)"
120.56.212.177 - - [19/May/2026:10:43:54 +0000] "POST /xmlrpc.php HTTP/1.1" 200 3392 "-" "WordPress.com; https://wordpress.com"
120.56.212.177 - - [19/May/2026:10:44:03 +0000] "POST /xmlrpc.php HTTP/1.1" 200 3391 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.3)"
120.56.212.177 - - [19/May/2026:10:44:15 +0000] "POST /xmlrpc.php HTTP/1.1" 200 3391 "-" "Jetpack/13.0; WordPress/6.3; http://site10694786.com"
show less
Brute-Force
🇫🇷
SpaceHost-Server
2026-05-21 22:25:58
(2 months ago)
Brute-Force
Web App Attack
🇫🇷
/dev/null
2026-05-20 11:06:39
(2 months ago)
WordPress login brute-force detected
Brute-Force
Exploited Host
🇧🇪
cmbplf
2026-05-20 00:36:09
(2 months ago)
3.937 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot
🇫🇷
SpaceHost-Server
2026-05-19 22:25:54
(2 months ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-19 22:05:35
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 18:05:28.375019 2026] [security2:error] [pid 8876:tid 8876] [client 120.56.212.177:54035] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 120.56.212.177 (+1 hits since last alert)|egelfitness.nl|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "egelfitness.nl"] [uri "/xmlrpc.php"] [unique_id "agzeqOZV60ZeCwppafzSSAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-19 21:20:02
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 17:19:55.804573 2026] [security2:error] [pid 28852:tid 28852] [client 120.56.212.177:64422] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 120.56.212.177 (+1 hits since last alert)|gvimmobilier.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "gvimmobilier.com"] [uri "/xmlrpc.php"] [unique_id "agzT-2EdVqwOZcNQcViJLwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-19 20:00:37
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 16:00:31.090924 2026] [security2:error] [pid 32127:tid 32127] [client 120.56.212.177:14437] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 120.56.212.177 (+1 hits since last alert)|apuntesdeinversion.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "apuntesdeinversion.com"] [uri "/xmlrpc.php"] [unique_id "agzBX7-PsCz5H2LCvbzk8wAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
konseptit
2026-05-19 16:53:38
(2 months ago)
(wordpress) Failed wordpress login from 120.56.212.177 (IN/India/-)
Brute-Force
2026-05-19 13:34:54
(2 months ago)
Bad Web Bot
Web App Attack
2026-05-19 13:17:06
(2 months ago)
120.56.212.177 - - [19/May/2026:15:16:47 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "WordPress.c ...
show more
120.56.212.177 - - [19/May/2026:15:16:47 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "WordPress.com; https://wordpress.com"
120.56.212.177 - - [19/May/2026:15:16:45 +0200] "POST /xmlrpc.php HTTP/1.0" 200 593 "-" "WordPress.com; https://wordpress.com"
120.56.212.177 - - [19/May/2026:15:16:54 +0200] "POST /xmlrpc.php HTTP/1.0" 200 593 "-" "Jetpack by WordPress.com"
120.56.212.177 - - [19/May/2026:15:16:55 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com"
120.56.212.177 - - [19/May/2026:15:17:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.4)"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-19 11:46:40
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 07:46:37.453105 2026] [security2:error] [pid 4477:tid 4477] [client 120.56.212.177:56158] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 120.56.212.177 (+1 hits since last alert)|speedysremodeling.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "speedysremodeling.com"] [uri "/xmlrpc.php"] [unique_id "agxNnWyQp5Guw9jB9VJehQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-19 11:16:21
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 07:16:13.897902 2026] [security2:error] [pid 22533:tid 22533] [client 120.56.212.177:64222] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 120.56.212.177 (+1 hits since last alert)|primemanagementmn.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "primemanagementmn.com"] [uri "/xmlrpc.php"] [unique_id "agxGfZ_7-KqCBh1ro5TiFgAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-19 08:38:50
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 04:38:47.125897 2026] [security2:error] [pid 4979:tid 4979] [client 120.56.212.177:54217] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 120.56.212.177 (+1 hits since last alert)|twinls.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "twinls.com"] [uri "/xmlrpc.php"] [unique_id "agwhlymiz0x_21V54KMLNQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-19 06:23:29
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 120.56.212.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 02:23:23.737277 2026] [security2:error] [pid 18784:tid 18784] [client 120.56.212.177:13119] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 120.56.212.177 (+1 hits since last alert)|realdesigninterior.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "realdesigninterior.com"] [uri "/xmlrpc.php"] [unique_id "agwB26QmuXjd5_K8x9yfsAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack