🇺🇸
TPI-Abuse
2026-07-31 22:21:19
(13 hours ago)
(mod_security) mod_security (id:225170) triggered by 168.167.81.175 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 168.167.81.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 18:21:14.544014 2026] [security2:error] [pid 3737499:tid 3737504] [client 168.167.81.175:63316] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||supercyprus.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "supercyprus.com"] [uri "/wp-json/wp/v2/users"] [unique_id "am0f2pUU1J_aEpMZvADPAwAAAMI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ConsulHosting
2026-07-31 21:42:25
(13 hours ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇺🇸
TPI-Abuse
2026-07-31 20:15:28
(15 hours ago)
(mod_security) mod_security (id:240335) triggered by 168.167.81.175 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 168.167.81.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 16:15:21.123067 2026] [security2:error] [pid 3495007:tid 3495007] [client 168.167.81.175:61836] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 168.167.81.175 (+1 hits since last alert)|forerunnersjazz.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "forerunnersjazz.org"] [uri "/xmlrpc.php"] [unique_id "am0CWTKo8iGKnW4ZwdAEIwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
dbmwebdesign
2026-07-31 19:00:05
(16 hours ago)
WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail
Brute-Force
Web App Attack
🇩🇪
LRob
2026-07-31 18:29:31
(17 hours ago)
CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc | req: /xmlrpc.php | UA: Jetpack by WordPress.co ...
show more
CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc | req: /xmlrpc.php | UA: Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.3)
show less
Brute-Force
Web App Attack
2026-07-31 17:59:31
(17 hours ago)
(wordpress) Failed wordpress login from 168.167.81.175 (BW/Botswana/-)
Brute-Force
🇦🇺
screwlooseit.com.au
2026-07-31 16:45:22
(18 hours ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
BW/Botswana/-
Web App Attack
🇩🇪
ghostwarriors
2026-07-31 16:20:26
(19 hours ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
2026-07-31 16:16:03
(19 hours ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
2026-07-31 16:05:32
(19 hours ago)
[redacted] 168.167.81.175 - - [31/Jul/2026:18:04:51 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" " ...
show more
[redacted] 168.167.81.175 - - [31/Jul/2026:18:04:51 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 168.167.81.175 - - [31/Jul/2026:18:04:59 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/13.0; WordPress/6.4; http://site49050278.com"
[redacted] 168.167.81.175 - - [31/Jul/2026:18:05:10 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/13.0; WordPress/6.3; http://site27164447.com"
[redacted] 168.167.81.175 - - [31/Jul/2026:18:05:22 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 168.167.81.175 - - [31/Jul/2026:18:05:31 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.1)"
...
show less
Hacking
Web App Attack
2026-07-31 16:05:18
(19 hours ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-31 15:35:59
(20 hours ago)
(mod_security) mod_security (id:240335) triggered by 168.167.81.175 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 168.167.81.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 11:35:52.600965 2026] [security2:error] [pid 2785648:tid 2785648] [client 168.167.81.175:64649] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 168.167.81.175 (+1 hits since last alert)|kiinlog.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kiinlog.com"] [uri "/xmlrpc.php"] [unique_id "amzA2ObDao3S5T9uCZc9QQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
alferez
2026-07-31 15:09:21
(20 hours ago)
xmlrpc.php attack DOS
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-07-31 13:43:44
(21 hours ago)
(mod_security) mod_security (id:240335) triggered by 168.167.81.175 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 168.167.81.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 09:43:37.973983 2026] [security2:error] [pid 550546:tid 550546] [client 168.167.81.175:60404] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 168.167.81.175 (+1 hits since last alert)|talentstar.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "talentstar.com"] [uri "/xmlrpc.php"] [unique_id "amymiUoBxXY1LXIxMR_4BQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-07-31 13:40:25
(22 hours ago)
5.338 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot