🇩🇪
Jochen Pretli
2026-09-26 23:44:48
UTC ·
(1 month ago)
connection to honeypot
Email Spam
Port Scan
🇨🇭
4server
2026-09-26 13:50:59
UTC ·
(1 month ago)
[SatSep2615:50:43.3141632026][security2:error][pid629032:tid629131][client36.83.134.241:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"96 ...
show more
[SatSep2615:50:43.3141632026][security2:error][pid629032:tid629131][client36.83.134.241:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"gsdsagl.ch\"][uri\"/xmlrpc.php\"][unique_id\"arfNsxCXtHYq0ivfBStJygAAAFA\"]
show less
Hacking
Web App Attack
🇺🇸
IndigoRidge
2026-09-26 13:12:55
UTC ·
(1 month ago)
36.83.134.241 - - [26/Sep/2026:09:11:33 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5168 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/93.0.0.0 Safari/537.36"
36.83.134.241 - - [26/Sep/2026:09:12:01 -04 ...
show more
36.83.134.241 - - [26/Sep/2026:09:11:33 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5168 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/93.0.0.0 Safari/537.36"
36.83.134.241 - - [26/Sep/2026:09:12:01 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5168 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/12.0.0.0 Safari/537.36"
36.83.134.241 - - [26/Sep/2026:09:12:21 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5168 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/74.0.0.0 Safari/537.36"
36.83.134.241 - - [26/Sep/2026:09:12:41 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5168 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36"
36.83.134.241 - - [26/Sep/2026:09:12:54 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5168 "-" "Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/96.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇸🇪
SkyDancer
2026-09-25 16:49:49
UTC ·
(1 month ago)
Multiple login attempts via RDP and/or SSH using wrong credentials. Attack automatically blocked by SkyDancer Ai via interface.
Hacking
Brute-Force
SSH
🇺🇦
URAN Publishing Service
2026-09-24 10:01:42
UTC ·
(1 month ago)
[24/Sep/2026:13:01:41 +0300] -- 36.83.134.241 Ban reason: Scanner [CMS_GENERIC] | Request: POST /xmlrpc.php HTTP/1.1
Bad Web Bot
Web App Attack
🇳🇿
Tripwire
2026-09-23 15:18:44
UTC ·
(1 month ago)
Probing for Wordpress - /xmlrpc.php
Brute-Force
Web App Attack
🇫🇮
inlink.ltd
2026-09-23 05:17:21
UTC ·
(1 month ago)
Known malicious PHP file or CMS probe
Web App Attack
🇨🇿
ddw
2026-09-23 00:23:11
UTC ·
(1 month ago)
WordPress XMLRPC.PHP Access Attempt.
Hacking
Web App Attack
🇩🇪
ghostwarriors
2026-09-23 00:20:11
UTC ·
(1 month ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-09-22 23:51:08
UTC ·
(1 month ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
Anonymous
2026-09-22 22:26:20
UTC ·
(1 month ago)
[redacted] 36.83.134.241 - - [23/Sep/2026:00:25:03 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/70.0.0.0 Safari/537.36"
[redacted] 36.83.134.241 - - [23/Sep/2026:0 ...
show more
[redacted] 36.83.134.241 - - [23/Sep/2026:00:25:03 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/70.0.0.0 Safari/537.36"
[redacted] 36.83.134.241 - - [23/Sep/2026:00:25:35 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/78.0.0.0 Safari/537.36"
[redacted] 36.83.134.241 - - [23/Sep/2026:00:25:37 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/77.0.0.0 Safari/537.36"
[redacted] 36.83.134.241 - - [23/Sep/2026:00:26:17 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/70.0.0.0 Safari/537.36"
[redacted] 36.83.134.241 - - [23/Sep/2026:00:26:19 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Linux; Android 10; ar
...
show less
Hacking
Web App Attack
🇨🇭
4server
2026-09-22 11:32:41
UTC ·
(1 month ago)
[TueSep2213:32:34.5763312026][security2:error][pid3322696:tid3322792][client36.83.134.241:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"614\"][id\" ...
show more
[TueSep2213:32:34.5763312026][security2:error][pid3322696:tid3322792][client36.83.134.241:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"614\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"stmconsulenze.ch\"][uri\"/xmlrpc.php\"][unique_id\"arJnUjBbVCHD5wPQ2x2p5QAAAEU\"]
show less
Hacking
Web App Attack
🇳🇴
jad-abuse
2026-09-21 15:44:57
UTC ·
(1 month ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 1 hits.
Brute-Force
Web App Attack
🇺🇸
IndigoRidge
2026-09-21 14:57:07
UTC ·
(1 month ago)
36.83.134.241 - - [21/Sep/2026:10:55:53 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5103 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/81.0.0.0 Safari/537.36"
36.83.134.241 - - [21/Sep/2026:10:56:12 -0400] "POST / ...
show more
36.83.134.241 - - [21/Sep/2026:10:55:53 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5103 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/81.0.0.0 Safari/537.36"
36.83.134.241 - - [21/Sep/2026:10:56:12 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5103 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/64.0.0.0 Safari/537.36"
36.83.134.241 - - [21/Sep/2026:10:56:30 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5103 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.0.0 Safari/537.36"
36.83.134.241 - - [21/Sep/2026:10:56:49 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5103 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/82.0.0.0 Safari/537.36"
36.83.134.241 - - [21/Sep/2026:10:57:06 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5103 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/12.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇳🇿
Tripwire
2026-09-21 06:00:25
UTC ·
(1 month ago)
Probing for Wordpress - /xmlrpc.php
Brute-Force
Web App Attack