2026-06-06 04:05:49
(1 week ago)
[redacted] 139.5.1.125 - - [06/Jun/2026:06:05:06 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Wor ...
show more
[redacted] 139.5.1.125 - - [06/Jun/2026:06:05:06 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 139.5.1.125 - - [06/Jun/2026:06:05:16 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.3)"
[redacted] 139.5.1.125 - - [06/Jun/2026:06:05:27 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.0; WordPress/6.4; http://site61575545.com"
[redacted] 139.5.1.125 - - [06/Jun/2026:06:05:37 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 139.5.1.125 - - [06/Jun/2026:06:05:48 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-06 03:38:00
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 139.5.1.125 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 139.5.1.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 23:37:51.199894 2026] [security2:error] [pid 13602:tid 13602] [client 139.5.1.125:40055] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 139.5.1.125 (+1 hits since last alert)|thingstodonude.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thingstodonude.com"] [uri "/xmlrpc.php"] [unique_id "aiOWDx3F1nrVSdDXp_xnTwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-06 03:06:10
(1 week ago)
Attac
Brute-Force
🇺🇸
TPI-Abuse
2026-06-06 01:55:14
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 139.5.1.125 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 139.5.1.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 21:55:07.242976 2026] [security2:error] [pid 26341:tid 26341] [client 139.5.1.125:39990] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 139.5.1.125 (+1 hits since last alert)|thehealthyplaceclayton.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thehealthyplaceclayton.com"] [uri "/xmlrpc.php"] [unique_id "aiN9-1VFevsjmwEwsoRwvgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
WeekendWeb
2026-06-06 01:21:04
(1 week ago)
Wordpress Vunerability attack
Web App Attack
2026-06-05 11:40:42
(1 week ago)
[ns3.backorder.gr] httpd-xmlrpc-post: sites=iatrika-analosima.gr; logs=/var/log/httpd/domains/iatrik ...
show more
[ns3.backorder.gr] httpd-xmlrpc-post: sites=iatrika-analosima.gr; logs=/var/log/httpd/domains/iatrika-analosima.gr.log; samples=/xmlrpc.php
show less
Brute-Force
Web App Attack
🇦🇺
screwlooseit.com.au
2026-06-05 11:38:57
(1 week ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
IN/India/-
Web App Attack
2026-06-05 11:00:37
(1 week ago)
Web App Attack, Hacking
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-05 10:39:42
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 139.5.1.125 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 139.5.1.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 06:39:36.006514 2026] [security2:error] [pid 26827:tid 26827] [client 139.5.1.125:60365] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 139.5.1.125 (+1 hits since last alert)|stlouisdave.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "stlouisdave.com"] [uri "/xmlrpc.php"] [unique_id "aiKnaLRt63nOPBnaj-LPbgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-02-06 15:22:46
(4 months ago)
Unauthorized connection attempt on Port 2323
Port Scan
Hacking
Exploited Host
2026-01-25 04:45:12
(4 months ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
2026-01-23 23:18:02
(4 months ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
2026-01-15 16:19:10
(5 months ago)
Unauthorized connection attempt on Port 2323
Port Scan
Hacking
Exploited Host
🇺🇸
Cyber Crusader
2026-01-14 19:12:58
(5 months ago)
Hundreds of Attempts (at least) to Connect to and Access Firewall Ports
Port Scan
Hacking
Brute-Force
🇺🇸
xmission.com
2025-12-07 21:20:38
(6 months ago)
Blocked by UFW (TCP on 8443)
Source port: 59107
TTL: 47
Packet length: 60
TOS: 0x00
This report (fo ...
show more
Blocked by UFW (TCP on 8443)
Source port: 59107
TTL: 47
Packet length: 60
TOS: 0x00
This report (for 139.5.1.125) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan