167.172.239.93

Probing websites for vulnerabilities

(PERMBLOCK) 167.172.239.93 (US/United States/-) has had more than 4 temp blocks

Jul 14 15:32:27 wordpress wordpress(acad-icht.tm.edu.ro)[96524]: XML-RPC authentication attempt for unknown user admin from 167.172.239.93 Jul 14 15:32:28 wordpress wordpress(acad-icht.tm.edu.ro)[96494]: XML-RPC authentication attempt for unknown use ... show more Jul 14 15:32:27 wordpress wordpress(acad-icht.tm.edu.ro)[96524]: XML-RPC authentication attempt for unknown user admin from 167.172.239.93 Jul 14 15:32:28 wordpress wordpress(acad-icht.tm.edu.ro)[96494]: XML-RPC authentication attempt for unknown user admin from 167.172.239.93 Jul 14 15:32:28 wordpress wordpress(acad-icht.tm.edu.ro)[96471]: XML-RPC authentication attempt for unknown user admin from 167.172.239.93 ... show less

Repeated wp-login/xmlrpc attempts

167.172.239.93 - - [14/Jul/2026:14:12:51 +0200] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404 567 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 167.172.239.93 - - [14/Jul/2 ... show more 167.172.239.93 - - [14/Jul/2026:14:12:51 +0200] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404 567 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 167.172.239.93 - - [14/Jul/2026:14:12:51 +0200] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 567 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 167.172.239.93 - - [14/Jul/2026:14:12:52 +0200] "GET /web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 567 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 167.172.239.93 - - [14/Jul/2026:14:12:52 +0200] "GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 567 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 167.172.239.93 - - [14/Jul/2026:14:12:52 +0200] "GET /website/wp-includes/wlwmanifest.xml HTT ... show less

Scraping with a high error ratio and request rate

(wordpress) Failed wordpress login from 167.172.239.93 (US/United States/-)

(mod_security) mod_security (id:225170) triggered by 167.172.239.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 07:20:41.471688 2026] [security2:error] [pid 21523:tid 21523] [client 167.172.239.93:55667] ... show more (mod_security) mod_security (id:225170) triggered by 167.172.239.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 07:20:41.471688 2026] [security2:error] [pid 21523:tid 21523] [client 167.172.239.93:55667] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hotelkona.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hotelkona.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "alYbieWX7PTGwnKjmWHmhgAAAAY"] show less

Web vulnerability probing: //wordpress/wp-includes/wlwmanifest.xml

(mod_security) mod_security (id:225170) triggered by 167.172.239.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 07:03:01.858252 2026] [security2:error] [pid 32348:tid 32348] [client 167.172.239.93:51290] ... show more (mod_security) mod_security (id:225170) triggered by 167.172.239.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 07:03:01.858252 2026] [security2:error] [pid 32348:tid 32348] [client 167.172.239.93:51290] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.dorismitchell.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.dorismitchell.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "alYXZd2ngzUV5-YPRC-QHgAAAAI"] show less

ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 20 hits.

Brute-force attack to identify web exploits

(wordpress) Failed wordpress login from 167.172.239.93 (US/United States/-)

http-probing - IP: 167.172.239.93 - time="2026-07-14T12:28:44+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-probing by ip 167.172.239.93 (US/14061) : 4h ban on Ip 167.172.239.93" module=db

(mod_security) mod_security (id:225170) triggered by 167.172.239.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 06:08:57.651325 2026] [security2:error] [pid 1150:tid 1150] [client 167.172.239.93:62885] M ... show more (mod_security) mod_security (id:225170) triggered by 167.172.239.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 06:08:57.651325 2026] [security2:error] [pid 1150:tid 1150] [client 167.172.239.93:62885] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hierrosbernal.ayudaclic.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hierrosbernal.ayudaclic.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "alYKuZyk4mJMUqmSjTaV_AAAABI"] show less