🇺🇸
TPI-Abuse
2026-07-16 00:01:45
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 195.101.98.222 (mairie-abbeville2.rain.fr): 1 i ...
show more
(mod_security) mod_security (id:225170) triggered by 195.101.98.222 (mairie-abbeville2.rain.fr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 20:01:36.684311 2026] [security2:error] [pid 20315:tid 20315] [client 195.101.98.222:49515] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rodzillacharters.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rodzillacharters.com"] [uri "/wp-json/wp/v2/users"] [unique_id "algfYMAP3U3p3CqPAbpexwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
MusicLibrary
2026-07-13 22:22:48
(4 days ago)
Attempted access to non existent wordpress urls
Bad Web Bot
🇳🇱
ParaBug
2026-07-13 17:51:59
(4 days ago)
195.101.98.222 - - [13/Jul/2026:19:51:59 +0200] "POST /xmlrpc.php HTTP/1.1" 301 4747 "-" "Mozilla/5. ...
show more
195.101.98.222 - - [13/Jul/2026:19:51:59 +0200] "POST /xmlrpc.php HTTP/1.1" 301 4747 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/13.0.0.0 Safari/537.36"
...
show less
Phishing
Brute-Force
Web App Attack
🇩🇪
Teufel100
2026-07-13 13:38:20
(4 days ago)
Brutforceangriff auf /xmlrpc.php
Brute-Force
Hacking
Web App Attack
🇬🇧
thetomtaylor.co.uk
2026-07-13 13:08:02
(4 days ago)
Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer ... [ice01,ice02,mx01,mx02,m ...
show more
Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer ... [ice01,ice02,mx01,mx02,mx03,wa01,wa02]
show less
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-07-13 05:41:49
(4 days ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
FR/France/mairie-abbeville2.rain.fr
Web App Attack
🇺🇸
TPI-Abuse
2026-07-13 05:41:40
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 195.101.98.222 (mairie-abbeville2.rain.fr): 1 i ...
show more
(mod_security) mod_security (id:225170) triggered by 195.101.98.222 (mairie-abbeville2.rain.fr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 01:41:34.327318 2026] [security2:error] [pid 10970:tid 10992] [client 195.101.98.222:58890] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jpdesign.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jpdesign.us"] [uri "/wp-json/wp/v2/users"] [unique_id "alR6jrbxhCLBezBmuuZDugAAANQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
wlt-blocker
2026-07-13 05:11:49
(4 days ago)
Unauthorized access to webpage admin
Web App Attack
🇺🇸
TPI-Abuse
2026-07-12 20:31:59
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 195.101.98.222 (mairie-abbeville2.rain.fr): 1 i ...
show more
(mod_security) mod_security (id:225170) triggered by 195.101.98.222 (mairie-abbeville2.rain.fr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 16:31:55.225426 2026] [security2:error] [pid 2444:tid 2444] [client 195.101.98.222:51876] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bennoyes.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bennoyes.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alP5u3tF5LHO2Qxw_hz7cwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-11 23:32:08
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 195.101.98.222 (mairie-abbeville2.rain.fr): 1 i ...
show more
(mod_security) mod_security (id:225170) triggered by 195.101.98.222 (mairie-abbeville2.rain.fr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 19:32:00.715158 2026] [security2:error] [pid 24884:tid 24912] [client 195.101.98.222:51068] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||darkestmoonart.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "darkestmoonart.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alLScHnVKym0hULmxQ_FQwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-11 01:08:54
(6 days ago)
(mod_security) mod_security (id:225170) triggered by 195.101.98.222 (mairie-abbeville2.rain.fr): 1 i ...
show more
(mod_security) mod_security (id:225170) triggered by 195.101.98.222 (mairie-abbeville2.rain.fr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 21:08:48.037932 2026] [security2:error] [pid 23177:tid 23177] [client 195.101.98.222:55990] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cnphilos.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cnphilos.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alGXoKcXHL2dRn8KGGWPJwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇬
securejdprop
2026-07-09 04:29:38
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing. crowdsecurity/http-probing
Hacking
Web App Attack
🇫🇮
bittiguru.fi
2026-07-09 03:55:04
(1 week ago)
195.101.98.222 - [09/Jul/2026:06:50:49 +0300] "POST /xmlrpc.php HTTP/1.1" 404 112750 "-" "Mozilla/5. ...
show more
195.101.98.222 - [09/Jul/2026:06:50:49 +0300] "POST /xmlrpc.php HTTP/1.1" 404 112750 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/76.0.0.0 Safari/537.36" "-"
195.101.98.222 - [09/Jul/2026:06:55:04 +0300] "POST /xmlrpc.php HTTP/1.1" 404 58463 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/12.0.0.0 Safari/537.36" "-"
...
show less
Hacking
Brute-Force
Web App Attack
🇩🇪
big-cloud.nl
2026-07-08 23:48:22
(1 week ago)
Try to access /xmlrpc.php
Web App Attack
2026-07-05 08:43:54
(1 week ago)
195.101.98.222 - - [05/Jul/2026:10:41:56 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Mozilla/5.0 ...
show more
195.101.98.222 - - [05/Jul/2026:10:41:56 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/78.0.0.0 Safari/537.36"
195.101.98.222 - - [05/Jul/2026:10:41:57 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/78.0.0.0 Safari/537.36"
195.101.98.222 - - [05/Jul/2026:10:43:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/100.0.0.0 Safari/537.36"
195.101.98.222 - - [05/Jul/2026:10:43:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/100.0.0.0 Safari/537.36"
195.101.98.222 - - [05/Jul/2026:10:43:53 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/14.0.0.0 Safari/537.36"
...
show less
Brute-Force
Web App Attack