🇺🇸
lcpacs
2026-09-01 08:42:25
(7 hours ago)
Auto-flagged by honeypot: tripped /xmlrpc.php
Bad Web Bot
Web App Attack
🇫🇷
ELYAZ
2026-08-31 16:12:54
(23 hours ago)
(wordpress) Failed wordpress login from 168.172.0.57 (-): (CF_ENABLE)
Brute-Force
🇩🇪
FD-IX
2026-08-31 11:37:48
(1 day ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇩🇪
Lino Project
2026-08-31 10:38:23
(1 day ago)
168.172.0.57 - - [31/Aug/2026:12:38:18 +0200] "POST /xmlrpc.php HTTP/1.1" 403 5320 "-" "Mozilla/5.0 ...
show more
168.172.0.57 - - [31/Aug/2026:12:38:18 +0200] "POST /xmlrpc.php HTTP/1.1" 403 5320 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/68.0.0.0 Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
Burayot
2026-08-31 09:19:06
(1 day ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 168.172.0.57 (-): 1 in the last 360 ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 168.172.0.57 (-): 1 in the last 3600 secs
show less
Web App Attack
🇳🇱
maxxsense
2026-08-24 03:55:47
(1 week ago)
(wordpress) Failed wordpress login from 168.172.0.57 (-)
Brute-Force
🇩🇪
wlt-blocker
2026-08-24 00:46:09
(1 week ago)
Unauthorized access to webpage admin
Web App Attack
🇫🇷
dynamix
2026-08-23 03:36:15
(1 week ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇷🇴
iulianh
2026-08-22 23:49:53
(1 week ago)
80,443
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-08-22 10:47:23
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 168.172.0.57 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 168.172.0.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 06:47:18.446976 2026] [security2:error] [pid 9589:tid 9589] [client 168.172.0.57:49338] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||themadwriter.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "themadwriter.us"] [uri "/wp-json/wp/v2/users"] [unique_id "aol-NqgLsUpLLQTBJpD1rQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-22 08:53:34
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 168.172.0.57 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 168.172.0.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 04:53:25.575878 2026] [security2:error] [pid 22084:tid 22104] [client 168.172.0.57:52318] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||sallykimmel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sallykimmel.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoljhQlL5ICq-qo5ps1CiQAAAco"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-22 05:07:28
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 168.172.0.57 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 168.172.0.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 01:07:20.899181 2026] [security2:error] [pid 25976:tid 25976] [client 168.172.0.57:51449] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||midwayisland.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "midwayisland.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aokuiMTesrP_tQxG5gjprwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇷
setupgr
2026-08-21 16:30:35
(1 week ago)
(XMLRPC) WP XMLRPC Attack 168.172.0.57 (ZA/South Africa/Gauteng/Pretoria/-/[AS2018 TENET-1]): 1 in t ...
show more
(XMLRPC) WP XMLRPC Attack 168.172.0.57 (ZA/South Africa/Gauteng/Pretoria/-/[AS2018 TENET-1]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 168.172.0.57 - - [21/Aug/2026:19:18:50 +0300] "POST /xmlrpc.php HTTP/1.1" 503 18928 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36"
show less
Port Scan
🇩🇪
wlt-blocker
2026-08-20 03:37:14
(1 week ago)
Unauthorized access to webpage admin
Web App Attack
🇺🇸
TPI-Abuse
2026-08-17 02:47:53
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 168.172.0.57 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 168.172.0.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 22:47:47.861765 2026] [security2:error] [pid 5572:tid 5572] [client 168.172.0.57:55821] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||havilahmalone.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "havilahmalone.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoJ2U85oZXUPARRBqbQHCgAAACg"]
show less
Brute-Force
Bad Web Bot
Web App Attack