🇫🇷
dynamix
2026-07-23 00:15:51
(6 hours ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇩🇪
rh24
2026-07-22 18:42:43
(11 hours ago)
(xmlrpc_405) XMLRPC-Bot 405 120.89.73.96 (IN/India/-)
Hacking
🇫🇮
YF
2026-07-22 18:30:42
(12 hours ago)
xmlrpc.php Potential DDoS or brute force
DDoS Attack
Brute-Force
🇺🇸
TPI-Abuse
2026-07-22 17:31:20
(13 hours ago)
(mod_security) mod_security (id:240335) triggered by 120.89.73.96 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 120.89.73.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 13:31:10.858013 2026] [security2:error] [pid 1186769:tid 1186769] [client 120.89.73.96:23123] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 120.89.73.96 (+1 hits since last alert)|kbalan.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kbalan.com"] [uri "/xmlrpc.php"] [unique_id "amD-XqL-UCrFwKuuBNktUwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
debestelapp
2026-07-22 12:35:06
(17 hours ago)
Web App Attack
🇩🇪
LRob
2026-07-22 11:36:04
(18 hours ago)
CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc | req: /xmlrpc.php | UA: Jetpack by WordPress.co ...
show more
CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc | req: /xmlrpc.php | UA: Jetpack by WordPress.com
show less
Brute-Force
Web App Attack
🇲🇾
Rizzy
2026-07-22 10:24:46
(20 hours ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-22 04:59:49
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 120.89.73.96 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 120.89.73.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 00:59:42.494933 2026] [security2:error] [pid 357325:tid 357325] [client 120.89.73.96:21993] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 120.89.73.96 (+1 hits since last alert)|method1.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "method1.net"] [uri "/xmlrpc.php"] [unique_id "amBOPl16MeoqRgEvbiEOugAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-22 04:07:32
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 120.89.73.96 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 120.89.73.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 00:07:23.952444 2026] [security2:error] [pid 242047:tid 242047] [client 120.89.73.96:22051] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 120.89.73.96 (+1 hits since last alert)|prostar.industries|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "prostar.industries"] [uri "/xmlrpc.php"] [unique_id "amBB-21v4EDtYZonDc9z3gAAAC4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
maxxsense
2026-07-22 01:40:09
(1 day ago)
(wordpress) Failed wordpress login from 120.89.73.96 (IN/India/-)
Brute-Force
🇱🇻
garmtech.com
2026-07-22 00:48:12
(1 day ago)
IM360 WAF: Rate limit exceeded for XMLRPC DoS (fault code)
Web App Attack
🇺🇸
TPI-Abuse
2026-07-22 00:10:52
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 120.89.73.96 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 120.89.73.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 20:10:41.921049 2026] [security2:error] [pid 620117:tid 620142] [client 120.89.73.96:23419] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 120.89.73.96 (+1 hits since last alert)|dwcmachining.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "dwcmachining.com"] [uri "/xmlrpc.php"] [unique_id "amAKgbN2QcbeGS97EpnTZAAAAFc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-07-22 00:07:10
(1 day ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-21 14:39:08
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 120.89.73.96 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 120.89.73.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 10:39:03.339905 2026] [security2:error] [pid 3163:tid 3163] [client 120.89.73.96:22548] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 120.89.73.96 (+1 hits since last alert)|circleinthesquare.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "circleinthesquare.org"] [uri "/xmlrpc.php"] [unique_id "al-Eh1gNZq_mQu4twuK-BAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-07-21 13:50:37
(1 day ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
IN/India/-
Web App Attack