🇳🇱
applemooz
2025-10-07 19:11:12
(8 months ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
🇳🇱
applemooz
2025-10-05 07:43:33
(8 months ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
🇩🇪
Marc
2025-10-05 01:49:30
(8 months ago)
Brute-Force
Web App Attack
2025-09-30 08:06:26
(8 months ago)
[redacted] 154.94.13.101 - - [30/Sep/2025:10:06:18 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "A ...
show more
[redacted] 154.94.13.101 - - [30/Sep/2025:10:06:18 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.28)"
[redacted] 154.94.13.101 - - [30/Sep/2025:10:06:18 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.28)"
[redacted] 154.94.13.101 - - [30/Sep/2025:10:06:19 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.28)"
[redacted] 154.94.13.101 - - [30/Sep/2025:10:06:20 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.28)"
[redacted] 154.94.13.101 - - [30/Sep/2025:10:06:25 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.28)"
...
show less
Hacking
Web App Attack
🇮🇹
www.tana.it
2025-09-29 20:52:36
(8 months ago)
PHP scan
Web App Attack
🇫🇮
YF
2025-09-27 04:00:47
(8 months ago)
xmlrpc.php (Potential DDoS or brute force)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-09-24 19:56:58
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 154.94.13.101 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 154.94.13.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 24 15:56:51.547420 2025] [security2:error] [pid 1581:tid 1581] [client 154.94.13.101:60675] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||webjemm.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "webjemm.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aNRNA3hD6culE61tgZfakQAAAA8"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Rip
2025-09-13 06:13:34
(8 months ago)
Apache Authentication attack. CMS Brute Force - Access Forbidden
Brute-Force
Web App Attack
🇨🇿
lp
2025-09-09 09:28:47
(9 months ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 154.94.13.101
2025-09-09T10:16:15+02: ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 154.94.13.101
2025-09-09T10:16:15+02:00 vpn Access-Reject 'xkarv12' station: 154.94.13.101 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇩🇪
Ba-Yu
2025-08-25 03:41:13
(9 months ago)
WP-xmlrpc exploit
Web Spam
Blog Spam
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2025-07-17 06:53:52
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 154.94.13.101 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 154.94.13.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 17 02:53:48.608660 2025] [security2:error] [pid 23157:tid 23157] [client 154.94.13.101:11337] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||herrell.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "herrell.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aHid_Hj_V7wq1Lpvq_99zgAAACI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-07-14 11:08:34
(10 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇦🇺
MAGIC
2025-06-04 08:10:27
(1 year ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇩🇪
stalker.to
2025-05-23 11:02:09
(1 year ago)
Datacenter Proxy
Web Spam
🇬🇧
uira.live
2025-05-04 15:54:45
(1 year ago)
Malicious activity detected from 200373 DREI-K-TECH-GMBH towards host uira.live (GET HTTP/2) @ 2025- ...
show more
Malicious activity detected from 200373 DREI-K-TECH-GMBH towards host uira.live (GET HTTP/2) @ 2025-05-04T15:54:45Z (2 occurrences)
show less
DDoS Attack