🇳🇱
applemooz
2025-10-07 13:50:33
(8 months ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
🇳🇱
applemooz
2025-10-06 05:47:22
(8 months ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
2025-09-30 17:23:36
(8 months ago)
[redacted] 154.213.193.202 - - [30/Sep/2025:19:23:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" ...
show more
[redacted] 154.213.193.202 - - [30/Sep/2025:19:23:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20"
[redacted] 154.213.193.202 - - [30/Sep/2025:19:23:22 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0"
[redacted] 154.213.193.202 - - [30/Sep/2025:19:23:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (Linux; U; Android 6.0.1; zh-CN; F5121 Build/34.0.A.1.247) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/40.0.2214.89 UCBrowser/11.5.1.944 Mobile Safari/537.36"
[redacted] 154.213.193.202 - - [30/Sep/2025:19:23:25 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.89 Safari/537.36"
[redacted] 154.213.193.202 - - [30/Sep/2025:19:23:26 +0200] "POST /xmlrpc.php HTTP
...
show less
Hacking
Web App Attack
🇫🇮
YF
2025-09-29 09:00:29
(8 months ago)
xmlrpc.php (Potential DDoS or brute force)
Brute-Force
Web App Attack
🇩🇪
neckaralb-admin.de
2025-09-27 08:43:33
(8 months ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
neckaralb-admin.de
2025-09-25 03:57:57
(8 months ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
Marc
2025-09-12 00:21:32
(9 months ago)
Brute-Force
Web App Attack
🇩🇪
Hary74656
2025-08-24 14:29:50
(9 months ago)
[Sun Aug 24 16:29:45.160384 2025] [authz_core:error] [pid 429416:tid 429487] [client 154.213.193.202 ...
show more
[Sun Aug 24 16:29:45.160384 2025] [authz_core:error] [pid 429416:tid 429487] [client 154.213.193.202:12217] AH01630: client denied by server configuration: /home/harald/www/aschi.at/xmlrpc.php
...
show less
Bad Web Bot
🇮🇩
Burayot
2025-08-22 18:55:52
(9 months ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 154.213.193.202 (FR/France/-): 1 in ...
show more
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 154.213.193.202 (FR/France/-): 1 in the last 3600 secs
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-08-22 13:54:39
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 154.213.193.202 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 154.213.193.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 22 09:54:33.696781 2025] [security2:error] [pid 8948:tid 8948] [client 154.213.193.202:57445] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.amazedbyu.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.amazedbyu.com"] [uri "/s3cmd.ini"] [unique_id "aKh2mTXHBHcCx_M7Hb5jzgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-22 11:47:00
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 154.213.193.202 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 154.213.193.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 22 07:46:53.591050 2025] [security2:error] [pid 3209:tid 3209] [client 154.213.193.202:33737] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.autowinder.tremulant.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.autowinder.tremulant.com"] [uri "/s3cmd.ini"] [unique_id "aKhYraBahOA1LhLEAyhxFAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-22 05:19:47
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 154.213.193.202 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 154.213.193.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 22 01:19:42.955196 2025] [security2:error] [pid 23642:tid 23642] [client 154.213.193.202:36617] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.bigblue4.us"] [uri "/config.php%7C/.env%7Csettings.py%7C/.yaml%7C/.yml"] [unique_id "aKf97oqLlghGbktHjZ-WcAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-22 04:33:17
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 154.213.193.202 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 154.213.193.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 22 00:33:14.493428 2025] [security2:error] [pid 2840:tid 2840] [client 154.213.193.202:15113] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.boyt.org|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.boyt.org"] [uri "/s3cmd.ini"] [unique_id "aKfzCkTBDJ0OOoX83Qw_IAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-15 16:35:06
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 154.213.193.202 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 154.213.193.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 15 12:35:00.518094 2025] [security2:error] [pid 23511:tid 23511] [client 154.213.193.202:51293] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||1writeforthegrant.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "1writeforthegrant.com"] [uri "/s3cmd.ini"] [unique_id "aJ9htLDIHlWa62cITA62lAAAACg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-08-02 18:58:41
(10 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH