🇩🇪
ghostwarriors
2026-07-10 08:51:16
(3 months ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
2026-07-10 07:27:20
(3 months ago)
[osotir.org] httpd-xmlrpc-post: sites=www.agonistes.gr; logs=/var/log/httpd/domains/agonistes.gr.log ...
show more
[osotir.org] httpd-xmlrpc-post: sites=www.agonistes.gr; logs=/var/log/httpd/domains/agonistes.gr.log; samples=/xmlrpc.php
show less
Brute-Force
Web App Attack
🇪🇸
masterguru
2026-07-10 04:35:02
(3 months ago)
(xmlrpc) Failed xmlrpc access from 175.101.99.77 (IN/India/-): 5 in the last 3600 secs (0-122)
Hacking
🇺🇸
TPI-Abuse
2026-07-10 04:34:47
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 175.101.99.77 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 175.101.99.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 00:34:42.041107 2026] [security2:error] [pid 16619:tid 16619] [client 175.101.99.77:60945] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 175.101.99.77 (+1 hits since last alert)|insidemilb.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "insidemilb.com"] [uri "/xmlrpc.php"] [unique_id "alB2Ym24wCyjR-Iw149qcQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-16 15:49:16
(3 months ago)
Fail2Ban - Wordpress brute-force
...
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-16 15:20:42
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 175.101.99.77 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 175.101.99.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 11:20:37.577291 2026] [security2:error] [pid 15369:tid 15369] [client 175.101.99.77:56838] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 175.101.99.77 (+1 hits since last alert)|tigerpathteam.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tigerpathteam.org"] [uri "/xmlrpc.php"] [unique_id "ajFpxXwa4pt0WSW7MzauDQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-16 12:08:44
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 175.101.99.77 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 175.101.99.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 08:08:39.823217 2026] [security2:error] [pid 6277:tid 6277] [client 175.101.99.77:61962] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 175.101.99.77 (+1 hits since last alert)|incrp.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "incrp.org"] [uri "/xmlrpc.php"] [unique_id "ajE8x_OyaxjQMVmZHXKHIQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-05-25 09:28:14
(4 months ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
nyt
2026-05-25 09:07:27
(4 months ago)
Repeated access to xmlrpc.php with 403 response, Repeated POST to xmlrpc.php, potential brute force. ...
show more
Repeated access to xmlrpc.php with 403 response, Repeated POST to xmlrpc.php, potential brute force., repeated auth/admin targeting (15 hits)
show less
Brute-Force
Web App Attack
2026-05-25 08:59:14
(4 months ago)
Attac
Brute-Force
🇺🇸
TPI-Abuse
2026-05-25 05:43:51
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 175.101.99.77 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 175.101.99.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 01:43:42.856024 2026] [security2:error] [pid 7853:tid 7853] [client 175.101.99.77:64776] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 175.101.99.77 (+1 hits since last alert)|genevainvestors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "genevainvestors.com"] [uri "/xmlrpc.php"] [unique_id "ahPhjvHiksXrATwzlcxjewAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
