2025-09-30 17:12:01
(8 months ago)
[redacted] 156.253.168.208 - - [30/Sep/2025:19:11:45 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" ...
show more
[redacted] 156.253.168.208 - - [30/Sep/2025:19:11:45 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)"
[redacted] 156.253.168.208 - - [30/Sep/2025:19:11:47 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (iPad; CPU OS 8_0 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A365 Safari/600.1.4"
[redacted] 156.253.168.208 - - [30/Sep/2025:19:11:51 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
[redacted] 156.253.168.208 - - [30/Sep/2025:19:11:51 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.5.5 (KHTML, like Gecko) Safari/125.11"
[redacted] 156.253.168.208 - - [30/Sep/2025:19:11:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-09-30 11:44:42
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 156.253.168.208 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.253.168.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 07:44:38.114199 2025] [security2:error] [pid 29888:tid 29888] [client 156.253.168.208:58903] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||despojosocial.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "despojosocial.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aNvCpls7-ubfVcaBGf926QAAABI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-09-28 23:57:35
(8 months ago)
WordPress Brute Force
Brute-Force
🇫🇷
dynamix
2025-09-28 23:50:03
(8 months ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇩🇪
neckaralb-admin.de
2025-09-27 10:10:24
(8 months ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇫🇮
YF
2025-09-26 18:01:15
(8 months ago)
xmlrpc.php (Potential DDoS or brute force)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-09-24 16:03:22
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 156.253.168.208 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.253.168.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 24 12:03:15.237504 2025] [security2:error] [pid 7404:tid 7404] [client 156.253.168.208:10911] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||climasyequipos.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "climasyequipos.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aNQWQ5HEGossNWCuv_o4DQAAAAE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Marc
2025-09-12 02:43:06
(9 months ago)
Brute-Force
2025-09-11 16:14:47
(9 months ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇦🇺
weblite
2025-09-03 03:18:54
(9 months ago)
WP_XMLRPC_ABUSE
Brute-Force
Web App Attack
2025-08-23 11:40:07
(10 months ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-08-22 17:47:38
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 156.253.168.208 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 156.253.168.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 22 13:47:32.488763 2025] [security2:error] [pid 7518:tid 7518] [client 156.253.168.208:60571] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.lakewyliehairsalon.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.lakewyliehairsalon.com"] [uri "/s3cmd.ini"] [unique_id "aKitNMoo7ZAABYgUL-dyrgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-22 17:11:41
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 156.253.168.208 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 156.253.168.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 22 13:11:36.076647 2025] [security2:error] [pid 1394:tid 1394] [client 156.253.168.208:47543] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.hatsizes.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.hatsizes.com"] [uri "/s3cmd.ini"] [unique_id "aKikyOwU_iDw6xRu6sdj9QAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-22 08:33:50
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 156.253.168.208 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 156.253.168.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 22 04:33:45.927192 2025] [security2:error] [pid 19460:tid 19460] [client 156.253.168.208:14405] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.ladylilac.lilachost.net"] [uri "/config.php%7C/.env%7Csettings.py%7C/.yaml%7C/.yml"] [unique_id "aKgracSsLo4UBbip05JoAQAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-17 15:04:34
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 156.253.168.208 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 156.253.168.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 17 11:04:30.110902 2025] [security2:error] [pid 7931:tid 7931] [client 156.253.168.208:57005] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||389thbg.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "389thbg.com"] [uri "/s3cmd.ini"] [unique_id "aKHvfqAS-oMPPu2swYh3JAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack