2026-07-20 10:33:06
(13 hours ago)
Bot / scanning and/or hacking attempts: GET /xmlrpc.php HTTP/1.1, POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇩🇪
ghostwarriors
2026-07-20 08:20:22
(15 hours ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
2026-07-20 08:06:29
(15 hours ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-07-19 22:57:10
(1 day ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-07-19 16:54:32
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 143.44.196.21 (143.44.196.21-rev.convergeict.co ...
show more
(mod_security) mod_security (id:225170) triggered by 143.44.196.21 (143.44.196.21-rev.convergeict.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 12:54:28.723502 2026] [security2:error] [pid 22520:tid 22520] [client 143.44.196.21:17578] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||agworldmissions.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "agworldmissions.org"] [uri "/wp-json/wp/v2/users"] [unique_id "al0BRMyZCtjR1KrmdQimGgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
stinpriza
2026-07-19 09:53:37
(1 day ago)
Web App Attack
Web App Attack
🇫🇷
ELYAZ
2026-07-19 01:12:11
(1 day ago)
(wordpress) Failed wordpress login from 143.44.196.21 (PH/Philippines/143.44.196.21-rev.convergeict. ...
show more
(wordpress) Failed wordpress login from 143.44.196.21 (PH/Philippines/143.44.196.21-rev.convergeict.com): (CF_ENABLE)
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-07-19 00:06:08
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 143.44.196.21 (143.44.196.21-rev.convergeict.co ...
show more
(mod_security) mod_security (id:225170) triggered by 143.44.196.21 (143.44.196.21-rev.convergeict.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 20:06:03.751413 2026] [security2:error] [pid 1200283:tid 1200283] [client 143.44.196.21:18563] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||salernospizza.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "salernospizza.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alwU6-jhA9cjQ2rDYVDazgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
MM-bot
2026-07-18 21:01:35
(2 days ago)
URL-probe: HTTP/1.1 POST request on /xmlrpc.php (2026-07-18 23:01:35 UTC+2)
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-07-18 11:08:16
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 143.44.196.21 (143.44.196.21-rev.convergeict.co ...
show more
(mod_security) mod_security (id:225170) triggered by 143.44.196.21 (143.44.196.21-rev.convergeict.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 07:08:11.471434 2026] [security2:error] [pid 20526:tid 20526] [client 143.44.196.21:28452] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||caddydad.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "caddydad.com"] [uri "/wp-json/wp/v2/users"] [unique_id "altem2xzsTwPA56CvrZ80AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-07-18 09:58:31
(2 days ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇳🇴
jad-abuse
2026-07-18 07:50:55
(2 days ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. O ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 1 hits.
show less
Brute-Force
Web App Attack
🇨🇭
4server
2026-07-18 04:20:39
(2 days ago)
[SatJul1806:20:35.9117902026][security2:error][pid3265154:tid3265674][client143.44.196.21:0]ModSecur ...
show more
[SatJul1806:20:35.9117902026][security2:error][pid3265154:tid3265674][client143.44.196.21:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"ruberticonsulting.ch\"][uri\"/xmlrpc.php\"][unique_id\"alr_E210VvjxhhZyBUIWngAAAFc\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-07-14 09:51:10
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 143.44.196.21 (143.44.196.21-rev.convergeict.co ...
show more
(mod_security) mod_security (id:225170) triggered by 143.44.196.21 (143.44.196.21-rev.convergeict.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 05:51:04.157185 2026] [security2:error] [pid 29071:tid 29071] [client 143.44.196.21:36184] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||whodatnation.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "whodatnation.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alYGiJtf2E3LUsnThgwEQwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
raymarron.com
2026-07-13 20:43:15
(1 week ago)
POST /xmlrpc.php
Web App Attack