🇺🇸
TPI-Abuse
2026-07-30 01:27:15
(9 hours ago)
(mod_security) mod_security (id:240335) triggered by 202.141.103.182 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 202.141.103.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 21:26:57.740484 2026] [security2:error] [pid 3043444:tid 3043444] [client 202.141.103.182:46737] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 202.141.103.182 (+1 hits since last alert)|pinebrookdesign.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pinebrookdesign.com"] [uri "/xmlrpc.php"] [unique_id "amqoYaVduMPyg1Szzjp6EgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Marc
2026-07-30 01:24:29
(9 hours ago)
202.141.103.182 - - [30/Jul/2026:03:24:09 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4775 "-" "Jetpack b ...
show more
202.141.103.182 - - [30/Jul/2026:03:24:09 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4775 "-" "Jetpack by WordPress.com" 202.141.103.182 - - [30/Jul/2026:03:24:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4776 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.1)" 202.141.103.182 - - [30/Jul/2026:03:24:29 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4776 "-" "WordPress.com; https://wordpress.com"
show less
Brute-Force
Web App Attack
🇦🇺
QT
2026-07-30 00:53:25
(10 hours ago)
Unauthorised WordPress admin login attempted at 2026-07-30 10:53:24 +1000
Web App Attack
🇺🇸
TPI-Abuse
2026-07-29 23:23:11
(11 hours ago)
(mod_security) mod_security (id:240335) triggered by 202.141.103.182 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 202.141.103.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 19:22:54.464861 2026] [security2:error] [pid 523484:tid 523484] [client 202.141.103.182:46720] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 202.141.103.182 (+1 hits since last alert)|adona.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "adona.org"] [uri "/xmlrpc.php"] [unique_id "amqLTny64_anjrRNN7LxgAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-07-29 22:09:51
(13 hours ago)
2.448 requests from abuseipdb.com blacklisted IP (1yr6mos1w)
Brute-Force
Bad Web Bot
🇳🇱
Site.eu
2026-07-29 21:50:16
(13 hours ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-07-29 20:49:52
(14 hours ago)
(mod_security) mod_security (id:240335) triggered by 202.141.103.182 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 202.141.103.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 16:49:37.659778 2026] [security2:error] [pid 3720937:tid 3720937] [client 202.141.103.182:18321] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 202.141.103.182 (+1 hits since last alert)|concentricsteel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "concentricsteel.com"] [uri "/xmlrpc.php"] [unique_id "ampnYRnNtkzYJw3EDX4twwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-29 20:17:59
(15 hours ago)
(wordpress) Failed wordpress login from 202.141.103.182 (IN/India/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-07-29 17:14:37
(18 hours ago)
(mod_security) mod_security (id:240335) triggered by 202.141.103.182 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 202.141.103.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 13:14:21.971212 2026] [security2:error] [pid 167001:tid 167001] [client 202.141.103.182:38619] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 202.141.103.182 (+1 hits since last alert)|firstunitedreserve.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "firstunitedreserve.com"] [uri "/xmlrpc.php"] [unique_id "amo07QeOTtLu-42K3IiY0QAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-29 15:08:03
(20 hours ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇺🇸
Dave Hansen
2026-07-29 13:07:17
(22 hours ago)
(wordpress) Failed wordpress login from 202.141.103.182 (IN/India/-)
Brute-Force
🇫🇷
dynamix
2026-07-29 07:34:52
(1 day ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
2026-07-29 07:00:00
(1 day ago)
Automated Apache web application probing in selected 24h window; attempts=279, unique_paths=1, error ...
show more
Automated Apache web application probing in selected 24h window; attempts=279, unique_paths=1, error_responses=121; targets include WordPress, .env/.git, phpMyAdmin, autodiscover, wpad.dat and related probe paths.
show less
Web App Attack
2026-07-29 07:00:00
(1 day ago)
Apache probe; attempts=279; exact paths: /xmlrpc.php
Web App Attack
🇦🇺
screwlooseit.com.au
2026-07-29 05:32:16
(1 day ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
IN/India/-
Web App Attack