🇳🇱
Site.eu
2026-08-08 13:36:30
UTC ·
(3 months ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇩🇪
wlt-blocker
2026-08-08 12:17:10
UTC ·
(3 months ago)
Unauthorized access to webpage admin
Web App Attack
🇫🇷
masterguru
2026-08-08 12:14:42
UTC ·
(3 months ago)
(xmlrpc) Apache: Failed xmlrpc access from 138.84.75.237 (PH/Philippines/-): 10 in the last 3600 secs (0-201)
Hacking
2026-08-08 09:55:30
UTC ·
(3 months ago)
[redacted] 138.84.75.237 - - [08/Aug/2026:11:54:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/64.0.0.0 Safari/537.36"
praxiszentrum-dedic.de 138.84.75.237 ...
show more
[redacted] 138.84.75.237 - - [08/Aug/2026:11:54:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/64.0.0.0 Safari/537.36"
praxiszentrum-dedic.de 138.84.75.237 - - [08/Aug/2026:11:54:25 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
[redacted] 138.84.75.237 - - [08/Aug/2026:11:54:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/76.0.0.0 Safari/537.36"
praxiszentrum-dedic.de 138.84.75.237 - - [08/Aug/2026:11:54:53 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/85.0.0.0 Safari/537.36"
[redacted] 138.84.75.237 - - [08/Aug/2026:11:54:55 +0200] "POST /xmlrpc.php
...
show less
Hacking
Web App Attack
2026-08-07 15:16:39
UTC ·
(3 months ago)
[redacted] 138.84.75.237 - - [07/Aug/2026:17:15:38 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
praxiszentrum-dedic.de 138.84.75.237 - - [07 ...
show more
[redacted] 138.84.75.237 - - [07/Aug/2026:17:15:38 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
praxiszentrum-dedic.de 138.84.75.237 - - [07/Aug/2026:17:15:39 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/72.0.0.0 Safari/537.36"
[redacted] 138.84.75.237 - - [07/Aug/2026:17:15:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/15.0.0.0 Safari/537.36"
praxiszentrum-dedic.de 138.84.75.237 - - [07/Aug/2026:17:15:55 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.0.0 Safari/537.36"
[redacted] 138.84.75.237 - - [07/Aug/2026:17:16:09 +0200] "POST /xmlrpc.php HTTP/1.1"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 14:13:27
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 138.84.75.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 10:13:21.659451 2026] [security2:error] [pid 1843283:tid 1843283] [client 138.84.75.237:1819 ...
show more
(mod_security) mod_security (id:225170) triggered by 138.84.75.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 10:13:21.659451 2026] [security2:error] [pid 1843283:tid 1843283] [client 138.84.75.237:1819] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||paleopathologist.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "paleopathologist.com"] [uri "/wp-json/wp/v2/users"] [unique_id "anXoAf7xshMuKhFcSej09wAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-08-07 09:02:57
UTC ·
(3 months ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇪🇸
masterguru
2026-08-07 06:07:27
UTC ·
(3 months ago)
(xmlrpc) Failed xmlrpc access from 138.84.75.237 (PH/Philippines/-): 5 in the last 3600 secs (0-122)
Hacking
🇩🇪
stinpriza
2026-08-07 06:02:41
UTC ·
(3 months ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-08-04 17:55:42
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 138.84.75.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 04 13:55:36.299863 2026] [security2:error] [pid 2137674:tid 2137674] [client 138.84.75.237:1384 ...
show more
(mod_security) mod_security (id:225170) triggered by 138.84.75.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 04 13:55:36.299863 2026] [security2:error] [pid 2137674:tid 2137674] [client 138.84.75.237:13843] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||redlitephotos.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "redlitephotos.com"] [uri "/wp-json/wp/v2/users"] [unique_id "anInmMIdKiRH7V4sOX4oNQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
Inartis
2026-08-03 11:08:06
UTC ·
(3 months ago)
138.84.75.237 - - [03/Aug/2026:13:07:16 +0200] "POST /xmlrpc.php HTTP/1.1" 302 5313 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/79.0.0.0 Safari/537.36"
138.84.75.237 - - [03/Aug/2026:13:07:18 +0200] "GET /xmlr ...
show more
138.84.75.237 - - [03/Aug/2026:13:07:16 +0200] "POST /xmlrpc.php HTTP/1.1" 302 5313 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/79.0.0.0 Safari/537.36"
138.84.75.237 - - [03/Aug/2026:13:07:18 +0200] "GET /xmlrpc.php HTTP/1.1" 403 5254 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/79.0.0.0 Safari/537.36"
138.84.75.237 - - [03/Aug/2026:13:08:06 +0200] "POST /xmlrpc.php HTTP/1.1" 302 5313 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/95.0.0.0 Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-03 03:07:57
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 138.84.75.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 02 23:07:53.762409 2026] [security2:error] [pid 657773:tid 657773] [client 138.84.75.237:41257] ...
show more
(mod_security) mod_security (id:225170) triggered by 138.84.75.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 02 23:07:53.762409 2026] [security2:error] [pid 657773:tid 657773] [client 138.84.75.237:41257] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||futuresgrowhere.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "futuresgrowhere.com"] [uri "/wp-json/wp/v2/users"] [unique_id "anAGCczv5Mp7FQDwasyBSQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
lespbaj
2026-08-02 10:34:02
UTC ·
(3 months ago)
{"time":"2026-08-02T10:34:00+00:00","ip":"138.84.75.237","method":"POST","uri":"/xmlrpc.php","ua":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36","referer":""}
...
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-31 15:03:25
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 138.84.75.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 11:03:21.308123 2026] [security2:error] [pid 693737:tid 693737] [client 138.84.75.237:36208] ...
show more
(mod_security) mod_security (id:225170) triggered by 138.84.75.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 11:03:21.308123 2026] [security2:error] [pid 693737:tid 693737] [client 138.84.75.237:36208] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cmcnow.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cmcnow.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amy5OZ1EAZTnkQ8NT1PvfwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-31 14:43:41
UTC ·
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 138.84.75.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 10:43:37.794014 2026] [security2:error] [pid 25180:tid 25191] [client 138.84.75.237:2757] Mo ...
show more
(mod_security) mod_security (id:225170) triggered by 138.84.75.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 10:43:37.794014 2026] [security2:error] [pid 25180:tid 25191] [client 138.84.75.237:2757] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||captechinc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "captechinc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amy0mYGZ9ZuYUKYnsVF90QAAAIY"]
show less
Brute-Force
Bad Web Bot
Web App Attack