🇺🇸
IndigoRidge
2026-10-20 11:00:16
UTC ·
(3 weeks ago)
138.84.154.13 - - [20/Oct/2026:06:55:19 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "WordPress.com; https://wordpress.com"
138.84.154.13 - - [20/Oct/2026:06:56:22 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "WordPress.com; https://wordpress.c ...
show more
138.84.154.13 - - [20/Oct/2026:06:55:19 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "WordPress.com; https://wordpress.com"
138.84.154.13 - - [20/Oct/2026:06:56:22 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "WordPress.com; https://wordpress.com"
138.84.154.13 - - [20/Oct/2026:06:56:32 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "WordPress.com; https://wordpress.com"
138.84.154.13 - - [20/Oct/2026:06:57:26 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "WordPress.com; https://wordpress.com"
138.84.154.13 - - [20/Oct/2026:07:00:15 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "WordPress.com; https://wordpress.com"
...
show less
Web App Attack
🇳🇱
ConsulHosting
2026-10-19 12:15:35
UTC ·
(3 weeks ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
2026-10-19 11:28:38
UTC ·
(3 weeks ago)
2026-10-19T11:28:11.945082+00:00 instance-20260804-1025 wordpress(expensas.co)[496143]: XML-RPC authentication failure for jmgomezp from 138.84.154.13
2026-10-19T11:28:26.383459+00:00 instance-20260804-1025 wordpress(expensas.co)[496230]: XML-RPC aut ...
show more
2026-10-19T11:28:11.945082+00:00 instance-20260804-1025 wordpress(expensas.co)[496143]: XML-RPC authentication failure for jmgomezp from 138.84.154.13
2026-10-19T11:28:26.383459+00:00 instance-20260804-1025 wordpress(expensas.co)[496230]: XML-RPC authentication failure for jmgomezp from 138.84.154.13
2026-10-19T11:28:37.456150+00:00 instance-20260804-1025 wordpress(expensas.co)[496232]: XML-RPC authentication failure for jmgomezp from 138.84.154.13
...
show less
Web App Attack
🇫🇷
dwmp
2026-10-19 06:56:12
UTC ·
(3 weeks ago)
WordPress login Brute-Force
Brute-Force
Web App Attack
🇺🇸
IndigoRidge
2026-10-19 01:56:39
UTC ·
(3 weeks ago)
138.84.154.13 - - [18/Oct/2026:21:55:14 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5180 "-" "WordPress.com; https://wordpress.com"
138.84.154.13 - - [18/Oct/2026:21:55:55 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5196 "-" "WordPress.com; https://wordpress.c ...
show more
138.84.154.13 - - [18/Oct/2026:21:55:14 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5180 "-" "WordPress.com; https://wordpress.com"
138.84.154.13 - - [18/Oct/2026:21:55:55 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5196 "-" "WordPress.com; https://wordpress.com"
138.84.154.13 - - [18/Oct/2026:21:55:56 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5180 "-" "WordPress.com; https://wordpress.com"
138.84.154.13 - - [18/Oct/2026:21:56:27 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5180 "-" "WordPress.com; https://wordpress.com"
138.84.154.13 - - [18/Oct/2026:21:56:38 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5180 "-" "WordPress.com; https://wordpress.com"
...
show less
Web App Attack
🇺🇸
鬼影233
2026-09-24 05:53:38
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-13 13:06:25
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 138.84.154.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 09:06:20.209366 2026] [security2:error] [pid 13362:tid 13362] [client 138.84.154.13:11528] M ...
show more
(mod_security) mod_security (id:225170) triggered by 138.84.154.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 09:06:20.209366 2026] [security2:error] [pid 13362:tid 13362] [client 138.84.154.13:11528] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||aholsniffsglue.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aholsniffsglue.com"] [uri "/wp-json/wp/v2/users"] [unique_id "an3BTAReCu5c5qTYJOIdWAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-13 09:57:58
UTC ·
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 138.84.154.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 05:57:51.332154 2026] [security2:error] [pid 187077:tid 187077] [client 138.84.154.13:1628] ...
show more
(mod_security) mod_security (id:240335) triggered by 138.84.154.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 05:57:51.332154 2026] [security2:error] [pid 187077:tid 187077] [client 138.84.154.13:1628] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 138.84.154.13 (+1 hits since last alert)|ardath.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ardath.net"] [uri "/xmlrpc.php"] [unique_id "an2VH9999XqU8CHTkSOUdQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-13 08:14:41
UTC ·
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 138.84.154.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 04:14:34.669678 2026] [security2:error] [pid 371576:tid 371576] [client 138.84.154.13:11774] ...
show more
(mod_security) mod_security (id:240335) triggered by 138.84.154.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 04:14:34.669678 2026] [security2:error] [pid 371576:tid 371576] [client 138.84.154.13:11774] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 138.84.154.13 (+1 hits since last alert)|plazahacienda.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "plazahacienda.com"] [uri "/xmlrpc.php"] [unique_id "an186r-HkbvyYIKxWP2y5AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
abdubhai
2026-08-13 06:50:00
UTC ·
(3 months ago)
138.84.154.13 - - [13/Aug/2026:1
...
Brute-Force
🇳🇱
debestelapp
2026-08-13 06:25:08
UTC ·
(3 months ago)
Web App Attack
🇩🇪
ghostwarriors
2026-08-13 04:20:27
UTC ·
(3 months ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
konseptit
2026-08-13 04:05:38
UTC ·
(3 months ago)
(wordpress) Failed wordpress login from 138.84.154.13 (PH/Philippines/-)
Brute-Force
🇩🇪
FD-IX
2026-08-13 04:04:04
UTC ·
(3 months ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
