🇳🇱
Site.eu
2026-08-26 17:20:22
(4 days ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-08-25 08:57:02
(6 days ago)
(mod_security) mod_security (id:240335) triggered by 39.51.54.49 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 39.51.54.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 04:56:57.113229 2026] [security2:error] [pid 20188:tid 20188] [client 39.51.54.49:56095] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.51.54.49 (+1 hits since last alert)|rentkase.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rentkase.com"] [uri "/xmlrpc.php"] [unique_id "ao1Y2cPEoRs1D-5ctBUXZwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-25 07:22:58
(6 days ago)
39.51.54.49 - - [25/Aug/2026:09:22:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack/12.5; ...
show more
39.51.54.49 - - [25/Aug/2026:09:22:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack/12.5; WordPress/6.1; http://site57162155.com"
39.51.54.49 - - [25/Aug/2026:09:22:39 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack/12.5; WordPress/6.1; http://site57162155.com"
39.51.54.49 - - [25/Aug/2026:09:22:45 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.3)"
39.51.54.49 - - [25/Aug/2026:09:22:46 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.3)"
39.51.54.49 - - [25/Aug/2026:09:22:55 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)"
...
show less
Brute-Force
Web App Attack
2026-08-25 07:17:19
(6 days ago)
[redacted] 39.51.54.49 - - [25/Aug/2026:09:16:36 +0200] "POST /xmlrpc.php HTTP/1.1" 403 43 "-" "Word ...
show more
[redacted] 39.51.54.49 - - [25/Aug/2026:09:16:36 +0200] "POST /xmlrpc.php HTTP/1.1" 403 43 "-" "WordPress.com; https://wordpress.com"
[redacted] 39.51.54.49 - - [25/Aug/2026:09:16:46 +0200] "POST /xmlrpc.php HTTP/1.1" 403 43 "-" "Jetpack by WordPress.com"
[redacted] 39.51.54.49 - - [25/Aug/2026:09:16:57 +0200] "POST /xmlrpc.php HTTP/1.1" 403 43 "-" "Jetpack/13.0; WordPress/6.2; http://site32950370.com"
[redacted] 39.51.54.49 - - [25/Aug/2026:09:17:07 +0200] "POST /xmlrpc.php HTTP/1.1" 403 43 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2)"
[redacted] 39.51.54.49 - - [25/Aug/2026:09:17:18 +0200] "POST /xmlrpc.php HTTP/1.1" 403 43 "-" "Jetpack by WordPress.com"
...
show less
Hacking
Web App Attack
🇳🇱
Site.eu
2026-08-24 14:28:31
(6 days ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇫🇷
applemooz
2026-08-24 12:12:30
(6 days ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-08-24 11:33:04
(6 days ago)
11.985 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-24 08:01:36
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 39.51.54.49 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 39.51.54.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 04:01:28.169630 2026] [security2:error] [pid 27105:tid 27131] [client 39.51.54.49:51061] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.51.54.49 (+1 hits since last alert)|wnsi.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "wnsi.org"] [uri "/xmlrpc.php"] [unique_id "aov6WMrKSEAbhh8z12qmqQAAANg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-08-21 12:35:22
(1 week ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-08-21 12:34:57
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 39.51.54.49 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 39.51.54.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 08:34:52.073133 2026] [security2:error] [pid 19660:tid 19660] [client 39.51.54.49:55760] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.51.54.49 (+1 hits since last alert)|insidepublications.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "insidepublications.com"] [uri "/xmlrpc.php"] [unique_id "aohF7MbmrZnaTWA8XkbrKgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-08-21 12:08:16
(1 week ago)
(xmlrpc) Apache: Failed xmlrpc access from 39.51.54.49 (PK/Pakistan/-): 10 in the last 3600 secs (0- ...
show more
(xmlrpc) Apache: Failed xmlrpc access from 39.51.54.49 (PK/Pakistan/-): 10 in the last 3600 secs (0-180)
show less
Hacking
🇺🇸
TPI-Abuse
2026-08-21 12:06:44
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 39.51.54.49 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 39.51.54.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 08:06:38.147705 2026] [security2:error] [pid 14387:tid 14387] [client 39.51.54.49:56148] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.51.54.49 (+1 hits since last alert)|havilahmalone.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "havilahmalone.com"] [uri "/xmlrpc.php"] [unique_id "aog_TjW1LpE2wluTDtSAYwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
integrantservices.com
2026-08-21 09:51:12
(1 week ago)
(wordpress) Failed wordpress login from 39.51.54.49 (PK/Pakistan/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-08-20 14:32:31
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 39.51.54.49 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 39.51.54.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 10:32:25.636040 2026] [security2:error] [pid 32195:tid 32195] [client 39.51.54.49:47364] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.51.54.49 (+1 hits since last alert)|agworldmissions.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "agworldmissions.org"] [uri "/xmlrpc.php"] [unique_id "aocP-a9MG-oHOn1zGmX7nQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-20 14:16:17
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 39.51.54.49 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 39.51.54.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 10:16:12.581902 2026] [security2:error] [pid 23340:tid 23340] [client 39.51.54.49:56562] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 39.51.54.49 (+1 hits since last alert)|agrollum.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "agrollum.com"] [uri "/xmlrpc.php"] [unique_id "aocMLON117E1jZzdNOjgEwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack