🇺🇸
factor1
2026-07-06 03:55:50
(3 hours ago)
Fail2ban at apollo Reports Abuse.
Bad Web Bot
🇩🇪
pltcldvlpr
2026-07-04 16:55:34
(1 day ago)
CMS/framework probe: 2.49.8.55 - - [04/Jul/2026:18:55:33 +0200] "POST /xmlrpc.php HTTP/1.1" 301 178 ...
show more
CMS/framework probe: 2.49.8.55 - - [04/Jul/2026:18:55:33 +0200] "POST /xmlrpc.php HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.0.0 Safari/537.36" asn=5384 org="EMIRATES TELECOMMUNICATIONS GROUP COMPANY (ETISALAT GROUP) PJSC" country=AE
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-07-04 14:39:33
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 2.49.8.55 (bba-2-49-8-55.alshamil.net.ae): 1 in ...
show more
(mod_security) mod_security (id:225170) triggered by 2.49.8.55 (bba-2-49-8-55.alshamil.net.ae): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 04 10:39:26.612741 2026] [security2:error] [pid 32469:tid 32486] [client 2.49.8.55:56173] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||plumeraproductions.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "plumeraproductions.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akkbHlmT4ExfckAAHHJryQAAAQ4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-07-04 10:11:21
(1 day ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
AE/United Arab Emirates/bba-2-49-8-55.alshamil.net.ae
Web App Attack
🇺🇸
TPI-Abuse
2026-07-03 18:04:12
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 2.49.8.55 (bba-2-49-8-55.alshamil.net.ae): 1 in ...
show more
(mod_security) mod_security (id:225170) triggered by 2.49.8.55 (bba-2-49-8-55.alshamil.net.ae): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 14:04:06.286452 2026] [security2:error] [pid 20628:tid 20628] [client 2.49.8.55:61503] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||sandpointidaho.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sandpointidaho.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akf5lqtyFlJIoPf7wfFNUAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-07-03 17:28:36
(2 days ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
big-cloud.nl
2026-07-03 16:10:19
(2 days ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-07-03 16:08:36
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 2.49.8.55 (bba-2-49-8-55.alshamil.net.ae): 1 in ...
show more
(mod_security) mod_security (id:225170) triggered by 2.49.8.55 (bba-2-49-8-55.alshamil.net.ae): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 12:08:31.878364 2026] [security2:error] [pid 23864:tid 23864] [client 2.49.8.55:52405] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||oowoah.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "oowoah.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akfef3xHxVKZeEXSY3jD7QAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-03 15:45:24
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 2.49.8.55 (bba-2-49-8-55.alshamil.net.ae): 1 in ...
show more
(mod_security) mod_security (id:225170) triggered by 2.49.8.55 (bba-2-49-8-55.alshamil.net.ae): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 11:45:15.978653 2026] [security2:error] [pid 23565:tid 23565] [client 2.49.8.55:57634] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||newmooncafe.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "newmooncafe.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akfZC0onasAuv_2L8C63zAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
NerdyMcNerderson
2026-07-02 18:50:00
(3 days ago)
MarekCloud auto-ban: PHP scanner: POST /xmlrpc.php
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-07-02 03:41:22
(4 days ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack