🇫🇷
dynamix
2026-08-27 16:34:37
(6 days ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇱🇻
garmtech.com
2026-05-29 10:46:23
(3 months ago)
IM360 WAF: Rate limit exceeded for XMLRPC DoS
Web App Attack
🇺🇸
TPI-Abuse
2026-05-22 23:04:30
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 22 19:04:22.815592 2026] [security2:error] [pid 18522:tid 18522] [client 200.233.141.193:55269] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 200.233.141.193 (+1 hits since last alert)|canebrakes.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "canebrakes.com"] [uri "/xmlrpc.php"] [unique_id "ahDg9j4fTQIF9Mng8vZKJAAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-22 20:48:13
(3 months ago)
[redacted] 200.233.141.193 - - [22/May/2026:22:47:31 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" ...
show more
[redacted] 200.233.141.193 - - [22/May/2026:22:47:31 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/13.0; WordPress/6.3; http://site14919796.com"
[redacted] 200.233.141.193 - - [22/May/2026:22:47:40 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.1)"
[redacted] 200.233.141.193 - - [22/May/2026:22:47:51 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.1)"
[redacted] 200.233.141.193 - - [22/May/2026:22:48:01 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 200.233.141.193 - - [22/May/2026:22:48:12 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
...
show less
Hacking
Web App Attack
🇦🇺
QT
2026-05-22 18:45:06
(3 months ago)
Unauthorised WordPress admin login attempted at 2026-05-23 04:45:04 +1000
Web App Attack
2026-05-22 16:12:47
(3 months ago)
Attac
Brute-Force
2026-05-22 13:07:03
(3 months ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-05-19 11:54:24
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 07:54:19.151106 2026] [security2:error] [pid 2077:tid 2077] [client 200.233.141.193:52784] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 200.233.141.193 (+1 hits since last alert)|midway-island.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "midway-island.com"] [uri "/xmlrpc.php"] [unique_id "agxPa8Slv0Rzioypjs9KIQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Kenshin869
2026-05-14 17:36:04
(3 months ago)
Wordpress unauthorized access attempt
Brute-Force
🇺🇸
TPI-Abuse
2026-05-14 15:08:20
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 11:08:12.928932 2026] [security2:error] [pid 16026:tid 16026] [client 200.233.141.193:65079] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 200.233.141.193 (+1 hits since last alert)|acarsubscription.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "acarsubscription.com"] [uri "/xmlrpc.php"] [unique_id "agXlXJBP5KcjWTURlHnBDgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
burlacu.org
2026-05-14 14:15:09
(3 months ago)
Nginx multi-log analysis detected: wordpress_scan. Evidence: XMLRPC abuse (multi-log) with 63 reques ...
show more
Nginx multi-log analysis detected: wordpress_scan. Evidence: XMLRPC abuse (multi-log) with 63 requests occurrences. Blocked automatically.
show less
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-04-28 13:43:29
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 09:43:21.873317 2026] [security2:error] [pid 31443:tid 31443] [client 200.233.141.193:63038] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 200.233.141.193 (+1 hits since last alert)|odysseydogasporlari.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "odysseydogasporlari.com"] [uri "/xmlrpc.php"] [unique_id "afC5eaCs-fTBwgUiestdKAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-28 11:40:54
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 07:40:48.802106 2026] [security2:error] [pid 1492:tid 1492] [client 200.233.141.193:64870] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 200.233.141.193 (+1 hits since last alert)|joeordie.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "joeordie.com"] [uri "/xmlrpc.php"] [unique_id "afCcwH62gsK9YIwksuaatAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-28 02:28:42
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 22:28:36.596344 2026] [security2:error] [pid 31927:tid 31927] [client 200.233.141.193:49576] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 200.233.141.193 (+1 hits since last alert)|saynotoofland.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "saynotoofland.org"] [uri "/xmlrpc.php"] [unique_id "afAbVL6ciTMKWWC7QU4dvgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-27 22:00:14
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 200.233.141.193 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 18:00:08.915289 2026] [security2:error] [pid 24345:tid 24345] [client 200.233.141.193:60555] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 200.233.141.193 (+1 hits since last alert)|newmooncafe.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "newmooncafe.com"] [uri "/xmlrpc.php"] [unique_id "ae_caAgQJWhIF78qOWyfHQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack