2026-05-17 23:44:16
(5 months ago)
Attac
Brute-Force
🇩🇪
dklueh79
2026-05-17 02:49:12
(5 months ago)
Probe for vulnerabilities. Path attempted: /xmlrpc.php
Web App Attack
🇳🇱
Site.eu
2026-05-15 18:36:17
(5 months ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇬🇧
pinguin
2026-05-15 14:00:49
(5 months ago)
Triggered Cloudflare WAF (firewallManaged) from MX.
Action taken: LOG
Protocol: HTTP/1.1 (POST metho ...
show more
Triggered Cloudflare WAF (firewallManaged) from MX.
Action taken: LOG
Protocol: HTTP/1.1 (POST method)
Endpoint: /xmlrpc.php
UA: Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/13.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇨🇭
4server
2026-05-13 06:31:07
(5 months ago)
[WedMay1308:31:01.6124092026][security2:error][pid1618205:tid1618797][client189.130.100.173:0]ModSec ...
show more
[WedMay1308:31:01.6124092026][security2:error][pid1618205:tid1618797][client189.130.100.173:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"367\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"xn--sanierung-feuchter-wnde-f8b.ch\"][uri\"/xmlrpc.php\"][unique_id\"agQapZ6M1rw2_ygFPmI2FAAAAAM\"]
show less
Hacking
Web App Attack
🇺🇸
mnsf
2026-05-11 17:07:20
(5 months ago)
Xmlrpc Caught (10)
Brute-Force
Web App Attack
🇩🇪
big-cloud.nl
2026-05-11 07:20:50
(5 months ago)
Try to access /xmlrpc.php
Web App Attack
🇧🇪
taivas.nl
2026-05-09 13:02:10
(5 months ago)
Wordpress_xmlrpc_attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-09 00:26:06
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 189.130.100.173 (dsl-173-100-130-189-dynamic.pr ...
show more
(mod_security) mod_security (id:225170) triggered by 189.130.100.173 (dsl-173-100-130-189-dynamic.prod-infinitum.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 20:25:59.750276 2026] [security2:error] [pid 5434:tid 5511] [client 189.130.100.173:18898] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fastesttrademark.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fastesttrademark.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af5_F9hj_Qh09tMgRADFEgAAAgk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-07 17:14:50
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 189.130.100.173 (dsl-173-100-130-189-dynamic.pr ...
show more
(mod_security) mod_security (id:225170) triggered by 189.130.100.173 (dsl-173-100-130-189-dynamic.prod-infinitum.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 13:14:42.308526 2026] [security2:error] [pid 4109:tid 4109] [client 189.130.100.173:16505] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||stlouisdave.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "stlouisdave.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afzIgvEr9SK_n36ueaB9ZwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
interbiznw.com
2026-05-07 10:03:59
(5 months ago)
malicious-web-requests-vulnerability-scanning
Hacking
Brute-Force
Exploited Host
Web App Attack
🇩🇪
barbarella
2026-05-07 09:28:58
(5 months ago)
Hacking attempt of Wordpress (scan for users/passwords) (POST /xmlrpc.php)
Hacking
Web App Attack
🇮🇳
dineshskt4all
2026-05-05 23:35:50
(5 months ago)
[Tue May 05 23:35:47.707410 2026] [proxy_fcgi:error] [pid 1517751:tid 123406859056832] [client 189.1 ...
show more
[Tue May 05 23:35:47.707410 2026] [proxy_fcgi:error] [pid 1517751:tid 123406859056832] [client 189.130.100.173:0] AH01071: Got error 'Primary script unknown'
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-05-05 05:16:39
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 189.130.100.173 (dsl-173-100-130-189-dynamic.pr ...
show more
(mod_security) mod_security (id:225170) triggered by 189.130.100.173 (dsl-173-100-130-189-dynamic.prod-infinitum.com.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 05 01:16:32.479511 2026] [security2:error] [pid 5606:tid 5606] [client 189.130.100.173:21287] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||pinebrookdesign.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "pinebrookdesign.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afl9MLt-vivKx1yqXTGyGgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-05-04 21:03:04
(5 months ago)
Try to access /xmlrpc.php
Web App Attack