2025-10-07 11:35:09
(7 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
2025-10-05 06:58:34
(8 months ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇩🇪
Marc
2025-10-05 06:35:19
(8 months ago)
Brute-Force
🇺🇸
TPI-Abuse
2025-10-05 02:10:33
(8 months ago)
(mod_security) mod_security (id:210831) triggered by 156.253.167.232 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210831) triggered by 156.253.167.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 04 22:10:25.971994 2025] [security2:error] [pid 28075:tid 28075] [client 156.253.167.232:37763] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||geckoturner.com|F|4"] [data "compatible ; MSIE"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "geckoturner.com"] [uri "/xmlrpc.php"] [unique_id "aOHTkTHyK4F_BpAEN6xVlgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
WeekendWeb
2025-10-04 14:09:32
(8 months ago)
Wordpress Vunerability attack
Web App Attack
2025-10-04 04:01:41
(8 months ago)
[redacted] 156.253.167.232 - - [04/Oct/2025:06:01:31 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" ...
show more
[redacted] 156.253.167.232 - - [04/Oct/2025:06:01:31 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (Linux; Android 7.1.1; CPH1723 Build/N6F26Q) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.98 Mobile Safari/537.36"
[redacted] 156.253.167.232 - - [04/Oct/2025:06:01:32 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:54.0) Gecko/20100101 Firefox/54.0"
[redacted] 156.253.167.232 - - [04/Oct/2025:06:01:34 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/600.3.18 (KHTML, like Gecko) Version/8.0.3 Safari/600.3.18"
[redacted] 156.253.167.232 - - [04/Oct/2025:06:01:35 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/412 (KHTML, like Gecko) Safari/412"
[redacted] 156.253.167.232 - - [04/Oct/2025:06:01:35 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (Linux; Android 7.0; Moto C Build/NRD90M.059)
...
show less
Hacking
Web App Attack
🇫🇮
YF
2025-09-29 22:00:52
(8 months ago)
xmlrpc.php (Potential DDoS or brute force)
Brute-Force
Web App Attack
🇦🇺
AWW-Admin
2025-09-28 07:14:22
(8 months ago)
(wordpress) Failed wordpress login from 156.253.167.232 (GB/United Kingdom/-)
Brute-Force
🇩🇪
Marc
2025-09-12 02:03:41
(8 months ago)
Brute-Force
🇩🇪
bsoft.de
2025-09-08 02:35:50
(8 months ago)
156.253.167.232 - - [08/Sep/2025:03:23:43 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5. ...
show more
156.253.167.232 - - [08/Sep/2025:03:23:43 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0"
156.253.167.232 - - [08/Sep/2025:03:50:34 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (Linux; Android 7.0; TRT-LX3 Build/HUAWEITRT-LX3; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/69.0.3497.100 Mobile Safari/537.36 [FB_IAB/FB4A;FBAV/194.0.0.42.99;]"
156.253.167.232 - - [08/Sep/2025:04:35:48 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0"
show less
Web App Attack
🇦🇺
weblite
2025-09-03 02:37:46
(9 months ago)
WP_XMLRPC_ABUSE
Brute-Force
Web App Attack
🇩🇪
Hary74656
2025-08-24 14:29:23
(9 months ago)
[Sun Aug 24 16:29:16.921148 2025] [authz_core:error] [pid 428834:tid 428895] [client 156.253.167.232 ...
show more
[Sun Aug 24 16:29:16.921148 2025] [authz_core:error] [pid 428834:tid 428895] [client 156.253.167.232:15295] AH01630: client denied by server configuration: /home/harald/www/aschi.at/xmlrpc.php
...
show less
Bad Web Bot
🇩🇪
Ba-Yu
2025-08-23 18:38:15
(9 months ago)
WP-xmlrpc exploit
Web Spam
Blog Spam
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2025-05-10 13:51:15
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 156.253.167.232 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.253.167.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 10 09:51:10.619631 2025] [security2:error] [pid 115869:tid 115869] [client 156.253.167.232:9133] [client 156.253.167.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lopansri.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lopansri.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aB9ZzuGrjgcTqmKU21fy6AAAAAg"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-08 10:24:21
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 156.253.167.232 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.253.167.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 08 06:24:17.761269 2025] [security2:error] [pid 2609020:tid 2609020] [client 156.253.167.232:58423] [client 156.253.167.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||endriss.info|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "endriss.info"] [uri "/wp-json/wp/v2/users"] [unique_id "aByGUYMTdCNuruciFPeZvAAAADo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack