🇫🇷
SpaceHost-Server
2026-06-28 16:16:20
(49 minutes ago)
202.163.81.126 - - [28/Jun/2026:18:15:59 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6476 "-" "Jetpack by ...
show more
202.163.81.126 - - [28/Jun/2026:18:15:59 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6476 "-" "Jetpack by WordPress.com"
202.163.81.126 - - [28/Jun/2026:18:16:09 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6476 "-" "WordPress.com; https://wordpress.com"
202.163.81.126 - - [28/Jun/2026:18:16:19 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6476 "-" "Jetpack by WordPress.com"
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-28 14:45:56
(2 hours ago)
(mod_security) mod_security (id:240335) triggered by 202.163.81.126 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 202.163.81.126 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 10:45:52.563182 2026] [security2:error] [pid 23006:tid 23006] [client 202.163.81.126:22063] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 202.163.81.126 (+1 hits since last alert)|briannalls.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "briannalls.com"] [uri "/xmlrpc.php"] [unique_id "akEzoO_LKC-U-8puEC_mPQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-06-28 14:44:18
(2 hours ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
2026-06-27 14:43:28
(1 day ago)
Bad Web Bot
Web App Attack
2026-06-25 14:14:19
(3 days ago)
Attac
Brute-Force
🇳🇱
Site.eu
2026-06-24 14:50:03
(4 days ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-06-24 12:40:06
(4 days ago)
(mod_security) mod_security (id:240335) triggered by 202.163.81.126 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 202.163.81.126 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 08:39:55.414446 2026] [security2:error] [pid 17331:tid 17331] [client 202.163.81.126:23232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 202.163.81.126 (+1 hits since last alert)|eta-mct.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "eta-mct.com"] [uri "/xmlrpc.php"] [unique_id "ajvQG-vQpRhit-G0ZOgIvgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ipoac.nl
2026-06-24 07:20:16
(4 days ago)
2026-06-24T09:20:15.394680+02:00 ipoac.nl wordpress(-)-: XML-RPC authentication failure for-from 202 ...
show more
2026-06-24T09:20:15.394680+02:00 ipoac.nl wordpress(-)-: XML-RPC authentication failure for-from 202.163.81.126
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 15:43:17
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 202.163.81.126 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 202.163.81.126 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 11:43:13.195447 2026] [security2:error] [pid 28797:tid 28797] [client 202.163.81.126:22414] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 202.163.81.126 (+1 hits since last alert)|greatwesternfirearms.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "greatwesternfirearms.com"] [uri "/xmlrpc.php"] [unique_id "ajqpkQKjK29vsRcQzGhSIAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
alferez
2026-06-23 14:06:23
(5 days ago)
xmlrpc.php attack DOS
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 10:09:13
(5 days ago)
(mod_security) mod_security (id:240335) triggered by 202.163.81.126 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 202.163.81.126 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 06:09:06.003369 2026] [security2:error] [pid 16087:tid 16087] [client 202.163.81.126:23134] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 202.163.81.126 (+1 hits since last alert)|firebelly.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "firebelly.org"] [uri "/xmlrpc.php"] [unique_id "ajpbQXKMHtQRtC3GeN_ZyQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
pscriptos
2026-06-23 07:03:17
(5 days ago)
{"ClientAddr":"202.163.81.126:23746","ClientHost":"202.163.81.126","ClientPort":"23746","ClientUsern ...
show more
{"ClientAddr":"202.163.81.126:23746","ClientHost":"202.163.81.126","ClientPort":"23746","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":444890914,"OriginContentSize":418,"OriginDuration":441528062,"OriginStatus":403,"Overhead":3362852,"RequestAddr":"www.cleveradmin.de","RequestContentSize":709,"RequestCount":1197969,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-06-23T09:02:56.88124096+02:00","StartUTC":"2026-06-23T07:02:56.88124096Z","TLSCipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLSVersion":"1.2","entryPointName":"websecure","level":"info","msg":"","time":"2026-06-23T09:02:57+02:00"}
{"ClientAddr":"202.163.81.126:23746","ClientHost":"202.163.81.126"
...
show less
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-06-22 14:45:30
(6 days ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
2026-06-22 09:55:03
(6 days ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 08:21:45
(6 days ago)
(mod_security) mod_security (id:240335) triggered by 202.163.81.126 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 202.163.81.126 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 04:21:39.553815 2026] [security2:error] [pid 2779:tid 2779] [client 202.163.81.126:23503] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 202.163.81.126 (+1 hits since last alert)|tedharris.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tedharris.com"] [uri "/xmlrpc.php"] [unique_id "ajjwk0fjzYPxKv9GJsZ5pAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack