🇺🇸
jcbriar
2026-11-14 05:08:58
UTC ·
(17 minutes ago)
Ignoring robots.txt
Bad Web Bot
🇺🇸
wbsouza
2026-11-10 03:43:57
UTC ·
(4 days ago)
CrowdSec: infra/bad-path-probe — automated firewall drops on self-hosted IDS sensor
Hacking
🇺🇸
xmission.com
2026-11-09 16:55:37
UTC ·
(4 days ago)
192.0.91.22 - - [09/Nov/2026:09:55:37 -0700] "POST /xmlrpc.php?for=jetpack HTTP/1.1" 301 162 "http://dooce.com/xmlrpc.php?for=jetpack" "The Incutio XML-RPC PHP Library"
...
Web App Attack
🇩🇪
maxpower
2026-10-30 21:09:38
UTC ·
(2 weeks ago)
(wp_fingerprint) REGOLA 6 - WP Exploit Attempt xmlrpc 192.0.91.22 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 192.0.91.22 - - [30/Oct/2026:22:09:33 +0100] "POST /xmlrpc.php?for=jetpack H ...
show more
(wp_fingerprint) REGOLA 6 - WP Exploit Attempt xmlrpc 192.0.91.22 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 192.0.91.22 - - [30/Oct/2026:22:09:33 +0100] "POST /xmlrpc.php?for=jetpack HTTP/1.1" 301 0 "http://www.professionedanza.org/xmlrpc.php?for=jetpack" "The Incutio XML-RPC PHP Library" "-" host=www.professionedanza.org
show less
Port Scan
🇺🇸
jcbriar
2026-09-13 09:45:44
UTC ·
(2 months ago)
Ignoring robots.txt
Bad Web Bot
🇺🇸
integrantservices.com
2026-08-24 00:59:12
UTC ·
(2 months ago)
(wordpress) Failed wordpress login from 192.0.91.22 (US/United States/-)
Brute-Force
2026-08-20 15:26:21
UTC ·
(2 months ago)
192.0.91.22 - - [20/Aug/2026:17:26:20 +0200] "POST /?for=jetpack&token=Yql8tKsTHpm%289pw8Vjqof%5E9UAvaq%24Gwv%3A1%3A0×tamp=1787239579&nonce=UuI2KICmrl&body-hash=pdst%2B%2B8gjpsEsdzTGdS19%2BYN3g4%3D&signature=zzTfjtXv7c1DhItkFS79PrzA%2FA4%3D HTTP ...
show more
192.0.91.22 - - [20/Aug/2026:17:26:20 +0200] "POST /?for=jetpack&token=Yql8tKsTHpm%289pw8Vjqof%5E9UAvaq%24Gwv%3A1%3A0×tamp=1787239579&nonce=UuI2KICmrl&body-hash=pdst%2B%2B8gjpsEsdzTGdS19%2BYN3g4%3D&signature=zzTfjtXv7c1DhItkFS79PrzA%2FA4%3D HTTP/1.1" 403 153 "https://www/?for=jetpack&token=Yql8tKsTHpm%289pw8Vjqof%5E9UAvaq%24Gwv%3A1%3A0×tamp=1787239579&nonce=UuI2KICmrl&body-hash=pdst%2B%2B8gjpsEsdzTGdS19%2BYN3g4%3D&signature=zzTfjtXv7c1DhItkFS79PrzA%2FA4%3D" "Jetpack by "
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-18 13:21:24
UTC ·
(2 months ago)
(mod_security) mod_security (id:240335) triggered by 192.0.91.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 09:21:17.066186 2026] [security2:error] [pid 3601:tid 3601] [client 192.0.91.22:9994] ModSecur ...
show more
(mod_security) mod_security (id:240335) triggered by 192.0.91.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 09:21:17.066186 2026] [security2:error] [pid 3601:tid 3601] [client 192.0.91.22:9994] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 192.0.91.22 (+1 hits since last alert)|rivercityacct.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rivercityacct.com"] [uri "/xmlrpc.php"] [unique_id "aoRcTY7AhjKKkq4VGErXMwAAABM"], referer: http://rivercityacct.com/xmlrpc.php?for=jetpack&token=y04%23HN%40sBgSPob61yu6L%297JmVuxd1v8A%3A1%3A1×tamp=1787059277&nonce=Qudt49VsWM&body-hash=l5MGKDtBMCRLlbhRxcm3udBaUGk%3D&signature=lJZfmqMSrPDUTARb7ttTv18GioM%3D
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-08-10 19:49:13
UTC ·
(3 months ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇩🇪
R.G.
2026-08-02 20:28:27
UTC ·
(3 months ago)
(XMLRPCorWHATEVER) Get lost please 192.0.91.22 (US/United States/-): 3 in the last 900 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇦🇺
screwlooseit.com.au
2026-06-30 23:34:18
UTC ·
(4 months ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
US/United States/-
Web App Attack
🇺🇸
TPI-Abuse
2026-06-30 17:30:16
UTC ·
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 192.0.91.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 13:30:08.537821 2026] [security2:error] [pid 18294:tid 18294] [client 192.0.91.22:7038] ModSec ...
show more
(mod_security) mod_security (id:240335) triggered by 192.0.91.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 13:30:08.537821 2026] [security2:error] [pid 18294:tid 18294] [client 192.0.91.22:7038] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 192.0.91.22 (+1 hits since last alert)|www.stationrestaurant.ca|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.stationrestaurant.ca"] [uri "/xmlrpc.php"] [unique_id "akP9II1Dk4x7muPXR1f9LgAAAAo"], referer: http://www.stationrestaurant.ca/xmlrpc.php?for=jetpack&token=%21BPKwHO505RjorjuZ%28Wsxd%5EzshiqTBNh%3A1%3A1×tamp=1782840608&nonce=upkIeLZ22A&body-hash=VzWp9sGjNy%2B6G%2Bn8S8ajQbdLGBs%3D&signature=0GcD2QFjNfKhI6qX2doDeih7K2o%3D
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
bigwavedave
2026-06-23 09:50:57
UTC ·
(4 months ago)
Wordpress Attack
Web App Attack
🇺🇸
integrantservices.com
2026-06-15 06:59:07
UTC ·
(4 months ago)
(wordpress) Failed wordpress login from 192.0.91.22 (US/United States/-)
Brute-Force
2026-06-08 08:24:05
UTC ·
(5 months ago)
[redacted] 192.0.91.22 - - [08/Jun/2026:10:23:53 +0200] "POST /xmlrpc.php?for=jetpack&token=1oN48%28jT%25%5EM4qdrX%21%2AHa6%240iUg%26Fjk%2AW%3A1%3A1×tamp=1780907033&nonce=gKPuqFjYql&body-hash=pdst%2B%2B8gjpsEsdzTGdS19%2BYN3g4%3D&signature=J%2Bfu ...
show more
[redacted] 192.0.91.22 - - [08/Jun/2026:10:23:53 +0200] "POST /xmlrpc.php?for=jetpack&token=1oN48%28jT%25%5EM4qdrX%21%2AHa6%240iUg%26Fjk%2AW%3A1%3A1×tamp=1780907033&nonce=gKPuqFjYql&body-hash=pdst%2B%2B8gjpsEsdzTGdS19%2BYN3g4%3D&signature=J%2Bfuar2GmCdsHBM8LEmg3dxFhAY%3D HTTP/1.1" 200 131 "https://www.[redacted]/xmlrpc.php?for=jetpack&token=1oN48%28jT%25%5EM4qdrX%21%2AHa6%240iUg%26Fjk%2AW%3A1%3A1×tamp=1780907033&nonce=gKPuqFjYql&body-hash=pdst%2B%2B8gjpsEsdzTGdS19%2BYN3g4%3D&signature=J%2Bfuar2GmCdsHBM8LEmg3dxFhAY%3D" "Jetpack by WordPress.com"
[redacted] 192.0.91.22 - - [08/Jun/2026:10:23:53 +0200] "POST /xmlrpc.php?for=jetpack HTTP/1.1" 200 228 "https://www.[redacted]/xmlrpc.php?for=jetpack" "WordPress.com; https://www.[redacted]"
[redacted] 192.0.91.22 - - [08/Jun/2026:10:23:54 +0200] "POST /xmlrpc.php?for=jetpack&token=a6Pf%5EWCvtfiJ8kY3pZP7pIvWa4S%29Jl12%3A1%3A0×tamp=1780907034&nonce=wDL7hrwGeF&body
...
show less
Hacking
Web App Attack
