2026-08-23 13:47:28
(1 day ago)
Scanner hitting /xmlrpc.php on () — aaguard
Brute-Force
Port Scan
🇳🇿
Tripwire
2026-08-22 22:52:48
(1 day ago)
Probing for Wordpress - /xmlrpc.php
Brute-Force
Web App Attack
🇩🇪
ghostwarriors
2026-08-22 21:50:19
(1 day ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
2026-08-22 21:33:41
(2 days ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-21 21:02:42
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 181.14.176.131 (host131.181-14-176.telecom.net. ...
show more
(mod_security) mod_security (id:225170) triggered by 181.14.176.131 (host131.181-14-176.telecom.net.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 17:02:35.284548 2026] [security2:error] [pid 22583:tid 22583] [client 181.14.176.131:57671] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fireteam.faith|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fireteam.faith"] [uri "/wp-json/wp/v2/users"] [unique_id "aoi86__zl5ytpfocb5ha1AAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-08-19 16:45:20
(5 days ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇫🇷
Kenshin869
2026-08-17 13:20:44
(1 week ago)
Wordpress unauthorized access attempt
Brute-Force
🇺🇸
TPI-Abuse
2026-08-16 17:12:30
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 181.14.176.131 (host131.181-14-176.telecom.net. ...
show more
(mod_security) mod_security (id:225170) triggered by 181.14.176.131 (host131.181-14-176.telecom.net.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 13:12:23.403905 2026] [security2:error] [pid 24756:tid 24756] [client 181.14.176.131:18770] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||allotrope.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "allotrope.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoHvd1Ht4mAiWL_88wKL4gAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-16 16:45:34
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 181.14.176.131 (host131.181-14-176.telecom.net. ...
show more
(mod_security) mod_security (id:225170) triggered by 181.14.176.131 (host131.181-14-176.telecom.net.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 12:45:31.226425 2026] [security2:error] [pid 27841:tid 27851] [client 181.14.176.131:62813] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||abusaimeh.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "abusaimeh.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoHpK-2Xn3Ujd5K3Rvy9AgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-08-16 13:39:24
(1 week ago)
[SunAug1615:39:17.5960072026][security2:error][pid3139231:tid3139488][client181.14.176.131:0]ModSecu ...
show more
[SunAug1615:39:17.5960072026][security2:error][pid3139231:tid3139488][client181.14.176.131:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"468\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"turismo-marocco-lugano.ch\"][uri\"/xmlrpc.php\"][unique_id\"aoG9hTWlkUnC0FTfnrwdzgAAANA\"]
show less
Hacking
Web App Attack
🇷🇴
iulianh
2026-08-16 13:37:41
(1 week ago)
80,443
Brute-Force
SSH
🇫🇷
dynamix
2026-08-14 16:57:00
(1 week ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇩🇪
wlt-blocker
2026-08-14 16:52:35
(1 week ago)
Unauthorized access to webpage admin
Web App Attack
🇩🇪
4server
2026-08-13 21:43:54
(1 week ago)
[ThuAug1323:43:50.8455392026][security2:error][pid1002753:tid1002765][client181.14.176.131:0]ModSecu ...
show more
[ThuAug1323:43:50.8455392026][security2:error][pid1002753:tid1002765][client181.14.176.131:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"hdcadvisory.ch\"][uri\"/xmlrpc.php\"][unique_id\"an46ljoVIxhpUIVntK6L5QAAAMk\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-13 20:06:11
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 181.14.176.131 (host131.181-14-176.telecom.net. ...
show more
(mod_security) mod_security (id:225170) triggered by 181.14.176.131 (host131.181-14-176.telecom.net.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 16:06:04.075952 2026] [security2:error] [pid 2784169:tid 2784169] [client 181.14.176.131:55419] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||forerunnersjazz.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "forerunnersjazz.org"] [uri "/wp-json/wp/v2/users"] [unique_id "an4jrGR3DcM626uCE2e0KgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack