🇺🇸
TPI-Abuse
2026-06-25 05:40:05
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 182.253.120.243 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 182.253.120.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 01:39:59.366311 2026] [security2:error] [pid 4252:tid 4252] [client 182.253.120.243:17343] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||semisysteme.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "semisysteme.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajy_LzvFAT5q5F6lQnV1ngAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
lespbaj
2026-06-25 03:01:46
(3 days ago)
{"time":"2026-06-25T03:01:44+00:00","ip":"182.253.120.243","method":"POST","uri":"/xmlrpc.php","ua": ...
show more
{"time":"2026-06-25T03:01:44+00:00","ip":"182.253.120.243","method":"POST","uri":"/xmlrpc.php","ua":"Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36","referer":""}
...
show less
Bad Web Bot
Web App Attack
🇳🇴
jad-abuse
2026-06-25 00:54:45
(3 days ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. O ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 1 hits.
show less
Brute-Force
Web App Attack
🇩🇪
botreporter
2026-06-25 00:14:10
(3 days ago)
botnet ignoring robots.txt
Bad Web Bot
2026-06-24 19:46:02
(3 days ago)
182.253.120.243 - - [24/Jun/2026:21:45:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 657 "-" "Mozilla/5. ...
show more
182.253.120.243 - - [24/Jun/2026:21:45:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 657 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/92.0.0.0 Safari/537.36"
182.253.120.243 - - [24/Jun/2026:21:45:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 847 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/92.0.0.0 Safari/537.36"
182.253.120.243 - - [24/Jun/2026:21:45:33 +0200] "POST /xmlrpc.php HTTP/1.1" 200 657 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/11.0.0.0 Safari/537.36"
182.253.120.243 - - [24/Jun/2026:21:45:32 +0200] "POST /xmlrpc.php HTTP/1.1" 200 847 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/11.0.0.0 Safari/537.36"
182.253.120.243 - - [24/Jun/2026:21:46:01 +0200] "POST /xmlrpc.php HTTP/1.1" 200 657 "-" "Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/82.0.0.0 Safari/537.
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 19:24:55
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 182.253.120.243 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 182.253.120.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 15:24:52.623810 2026] [security2:error] [pid 31818:tid 31826] [client 182.253.120.243:25961] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||frannykingsmith.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "frannykingsmith.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajwvBNvp3YwK2_HzZznt7wAAAIY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
bescared
2026-06-24 18:50:00
(3 days ago)
WAF (2) - Malicious activity detected: Form spam.
Web Spam
🇩🇪
4server
2026-06-24 15:26:49
(3 days ago)
[WedJun2417:26:46.4799112026][security2:error][pid355040:tid355060][client182.253.120.243:0]ModSecur ...
show more
[WedJun2417:26:46.4799112026][security2:error][pid355040:tid355060][client182.253.120.243:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"atelier-lara.ch\"][uri\"/xmlrpc.php\"][unique_id\"ajv3Ni-HgLB2zru5mmNjgQAAABE\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
wlt-blocker
2026-06-24 07:31:47
(4 days ago)
Unauthorized access to webpage admin
Web App Attack
🇳🇿
Tripwire
2026-06-24 04:03:59
(4 days ago)
Probing for Wordpress - /xmlrpc.php
Brute-Force
Web App Attack
🇩🇪
LRob.fr
2026-06-23 22:00:07
(4 days ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
2026-06-23 17:44:58
(4 days ago)
Web attack blocked by Wordfence on mezzia.nl (2 hits). Reported by CRMON.
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 15:50:08
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 182.253.120.243 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 182.253.120.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 11:50:02.225640 2026] [security2:error] [pid 3595:tid 3595] [client 182.253.120.243:45855] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||kawkacevents.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "kawkacevents.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajqrKuBWBHlaXyNpEWTnbQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack