🇩🇪
Carsten
2026-06-29 13:47:30
UTC ·
(4 months ago)
GET [error_403.php/blog/wp-includes/wlwmanifest.xml]
Port Scan
🇳🇱
Savvii
2026-06-29 13:47:26
UTC ·
(4 months ago)
15 attempts against mh-modsecurity-ban on hostbillst3
Brute-Force
Web App Attack
🇺🇦
URAN Publishing Service
2026-06-29 13:45:27
UTC ·
(4 months ago)
35.233.111.26 - - [29/Jun/2026:16:45:26 +0300] "GET /wp-includes/ID3/license.txt HTTP/1.1" 404 683 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
35.233.111.26 - - [29/Jun/2026 ...
show more
35.233.111.26 - - [29/Jun/2026:16:45:26 +0300] "GET /wp-includes/ID3/license.txt HTTP/1.1" 404 683 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
35.233.111.26 - - [29/Jun/2026:16:45:26 +0300] "GET /xmlrpc.php?rsd HTTP/1.1" 404 683 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
...
show less
Web App Attack
Anonymous
2026-06-29 13:40:18
UTC ·
(4 months ago)
Auto-reported by Fail2Ban (NPM-Auth)
Web App Attack
🇩🇪
mravb
2026-06-29 13:39:04
UTC ·
(4 months ago)
35.233.111.26 - - [29/Jun/2026:16:39:03 +0300] "GET //xmlrpc.php?rsd HTTP/1.1" 404 150 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
...
Web App Attack
Hacking
Anonymous
2026-06-29 13:34:03
UTC ·
(4 months ago)
Bot / scanning and/or hacking attempts: POST //xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇨🇭
Ribeye375
2026-06-29 13:29:50
UTC ·
(4 months ago)
HIPS rce-attempt - Block tcp/0:65535
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-29 13:22:07
UTC ·
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 35.233.111.26 (26.111.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 09:22:03.051200 2026] [security2:error] [pid 2567:tid 2 ...
show more
(mod_security) mod_security (id:240335) triggered by 35.233.111.26 (26.111.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 09:22:03.051200 2026] [security2:error] [pid 2567:tid 2567] [client 35.233.111.26:54023] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 35.233.111.26 (+1 hits since last alert)|hiidied.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "hiidied.com"] [uri "/xmlrpc.php"] [unique_id "akJxexQuGjvp5BrApYvyUQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
webanyone
2026-06-29 13:15:40
UTC ·
(4 months ago)
Repeated 404 errors, blocked by Fail2ban in custom-404 jail
Bad Web Bot
🇳🇱
Savvii
2026-06-29 13:13:37
UTC ·
(4 months ago)
10 attempts against mh-misc-ban on plum
Web App Attack
🇳🇿
Antinson
2026-06-29 13:13:16
UTC ·
(4 months ago)
Scraping with a high error ratio and request rate
Bad Web Bot
Anonymous
2026-06-29 13:12:48
UTC ·
(4 months ago)
[redacted] 35.233.111.26 - - [29/Jun/2026:15:12:44 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 35.233.111.26 - - [29/ ...
show more
[redacted] 35.233.111.26 - - [29/Jun/2026:15:12:44 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 35.233.111.26 - - [29/Jun/2026:15:12:45 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 35.233.111.26 - - [29/Jun/2026:15:12:45 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 35.233.111.26 - - [29/Jun/2026:15:12:45 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 35.233.111.26 - - [29/Jun/2026:15:12:46 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla
...
show less
Hacking
Web App Attack
🇳🇴
jad-abuse
2026-06-29 13:10:25
UTC ·
(4 months ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 14 hits.
Brute-Force
Web App Attack
🇩🇪
Ba-Yu
2026-06-29 13:01:43
UTC ·
(4 months ago)
WP-xmlrpc exploit
Web Spam
Blog Spam
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-29 12:55:13
UTC ·
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 35.233.111.26 (26.111.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 08:55:06.630618 2026] [security2:error] [pid 25130:tid ...
show more
(mod_security) mod_security (id:225170) triggered by 35.233.111.26 (26.111.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 08:55:06.630618 2026] [security2:error] [pid 25130:tid 25130] [client 35.233.111.26:61248] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||harwoodmechanical.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "harwoodmechanical.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akJrKp9TzTAC6ibjlkkZ7AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack