SEOAlexRamon
08 Aug 2022
POST /xmlrpc.php - Fail2Ban
Hacking
Web App Attack
websase.com
08 Aug 2022
WordPress XMLRPC Brute Force Attacks
Brute-Force
Web App Attack
akac
05 Aug 2022
WordPress XML-RPC attack attempt.
Request: POST /xmlrpc.php
User-Agent: Mozilla/5.0 (Win ... show more WordPress XML-RPC attack attempt.
Request: POST /xmlrpc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Body: <methodCall>
<methodName>wp.getUsersBlogs</methodName>
<params>
<param><value>admin</value></param>
<param><value>[email protected] </value></param>
</params>
</methodCall> show less
Web Spam
Brute-Force
Bad Web Bot
Web App Attack
MarkGGN
05 Aug 2022
Webexploits. 134.19.179.187 - - [06/Aug/2022:04:17:55 +0200] "POST /xmlrpc.php HTTP/2.0" 200 406 "-" ... show more Webexploits. 134.19.179.187 - - [06/Aug/2022:04:17:55 +0200] "POST /xmlrpc.php HTTP/2.0" 200 406 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"
134.19.179.187 - - [06/Aug/2022:04:27:16 +0200] "POST /xmlrpc.php HTTP/2.0" 200 406 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36" show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
31 Jul 2022
techno.ws 134.19.179.187 [31/Jul/2022:07:54:38 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5675 "-" "Mozi ... show more techno.ws 134.19.179.187 [31/Jul/2022:07:54:38 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5675 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"
techno.ws 134.19.179.187 [31/Jul/2022:07:54:41 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5675 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36" show less
Web App Attack
SleepyHosting
30 Jul 2022
(mod_security) mod_security (id:400010) triggered by 134.19.179.187 (NL/Netherlands/187.179.19.134.i ... show more (mod_security) mod_security (id:400010) triggered by 134.19.179.187 (NL/Netherlands/187.179.19.134.in-addr.arpa): 5 in the last 3600 secs show less
Brute-Force
pusathosting.com
30 Jul 2022
uvcm 134.19.179.187 [29/Jul/2022:10:56:39 "-" "POST /xmlrpc.php 200 694
134.19.179.187 [30/Jul ... show more uvcm 134.19.179.187 [29/Jul/2022:10:56:39 "-" "POST /xmlrpc.php 200 694
134.19.179.187 [30/Jul/2022:04:55:39 "-" "POST /xmlrpc.php 200 682
134.19.179.187 [31/Jul/2022:06:19:05 "-" "POST /xmlrpc.php 200 5743 show less
Brute-Force
Web App Attack
Anonymous
30 Jul 2022
[Sun Jul 31 01:21:30.318291 2022] [fcgid:warn] [pid 2112:tid 139670715987712] [client 134.19.179.187 ... show more [Sun Jul 31 01:21:30.318291 2022] [fcgid:warn] [pid 2112:tid 139670715987712] [client 134.19.179.187:45848] mod_fcgid: stderr: WP User : fredo authentication failure | IP : 134.19.179.187 | URL https://www.bfa-bs.ch/wp-admin/
[Sun Jul 31 01:22:00.116769 2022] [fcgid:warn] [pid 2173:tid 139670690809600] [client 134.19.179.187:53850] mod_fcgid: stderr: WP User : fredo authentication failure | IP : 134.19.179.187 | URL https://bagagebagage.com/wp-admin/
[Sun Jul 31 01:22:17.208319 2022] [fcgid:warn] [pid 2173:tid 139670690809600] [client 134.19.179.187:57308] mod_fcgid: stderr: WP User : fredo authentication failure | IP : 134.19.179.187 | URL https://www.garabullos.com/wp-admin/
... show less
Brute-Force
Web App Attack
John Chrys.
28 Jul 2022
134.19.179.187 - - [29/Jul/2022:06:52:53 +0300] "POST /xmlrpc.php HTTP/1.1" 403 5587 "-" "Mozilla/5. ... show more 134.19.179.187 - - [29/Jul/2022:06:52:53 +0300] "POST /xmlrpc.php HTTP/1.1" 403 5587 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"
... show less
Brute-Force
Web App Attack
websase.com
28 Jul 2022
WordPress XMLRPC Brute Force Attacks
Brute-Force
Web App Attack
SleepyHosting
28 Jul 2022
(mod_security) mod_security (id:400010) triggered by 134.19.179.187 (NL/Netherlands/187.179.19.134.i ... show more (mod_security) mod_security (id:400010) triggered by 134.19.179.187 (NL/Netherlands/187.179.19.134.in-addr.arpa): 5 in the last 3600 secs show less
Brute-Force
myagent.site
28 Jul 2022
Blocking for trying to access an exploit file: /xmlrpc.php
Hacking
websase.com
27 Jul 2022
WordPress XMLRPC Brute Force Attacks
Brute-Force
Web App Attack
etu brutus
20 Jul 2022
134.19.179.187 has been banned for [cms abuse]
...
Hacking
Brute-Force
akac
17 Jul 2022
WordPress XML-RPC attack attempt.
Request: POST /xmlrpc.php
User-Agent: Mozilla/5.0 (Win ... show more WordPress XML-RPC attack attempt.
Request: POST /xmlrpc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Body: <methodCall>
<methodName>wp.getUsersBlogs</methodName>
<params>
<param><value>admin</value></param>
<param><value>harley</value></param>
</params>
</methodCall> show less
Web Spam
Brute-Force
Bad Web Bot
Web App Attack