🇳🇱
Site.eu
2026-06-29 02:53:30
(1 hour ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
Jason Howell
2026-06-29 00:25:47
(3 hours ago)
40.160.67.166 - - [28/Jun/2026:19:17:00 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4738 "-" "Jetpack/12. ...
show more
40.160.67.166 - - [28/Jun/2026:19:17:00 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4738 "-" "Jetpack/12.1; WordPress/6.4; http://site91897812.com"
40.160.67.166 - - [28/Jun/2026:19:19:09 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4737 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.4)"
40.160.67.166 - - [28/Jun/2026:19:21:22 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4737 "-" "Jetpack/12.5; WordPress/6.4; http://site98009057.com"
40.160.67.166 - - [28/Jun/2026:19:23:33 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4738 "-" "Jetpack/12.1; WordPress/6.3; http://site97612457.com"
40.160.67.166 - - [28/Jun/2026:19:25:46 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4737 "-" "Jetpack by WordPress.com"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-28 23:51:25
(4 hours ago)
(mod_security) mod_security (id:240335) triggered by 40.160.67.166 (ns1027448.ip-40-160-67.us): 1 in ...
show more
(mod_security) mod_security (id:240335) triggered by 40.160.67.166 (ns1027448.ip-40-160-67.us): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 19:51:21.381369 2026] [security2:error] [pid 21081:tid 21081] [client 40.160.67.166:35432] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 40.160.67.166 (+1 hits since last alert)|harwoodmechanical.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "harwoodmechanical.com"] [uri "/xmlrpc.php"] [unique_id "akGzeb6dDBGNoRgVsEcmNwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-28 23:19:44
(4 hours ago)
(mod_security) mod_security (id:240335) triggered by 40.160.67.166 (ns1027448.ip-40-160-67.us): 1 in ...
show more
(mod_security) mod_security (id:240335) triggered by 40.160.67.166 (ns1027448.ip-40-160-67.us): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 19:19:37.348287 2026] [security2:error] [pid 6066:tid 6066] [client 40.160.67.166:35122] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 40.160.67.166 (+1 hits since last alert)|feministvoice.blog|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "feministvoice.blog"] [uri "/xmlrpc.php"] [unique_id "akGsCaEFRj6xVfPvKTB4UAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
n2nguyenn2nguyen
2026-06-28 23:17:33
(4 hours ago)
Blocked by YFC Security on https://fencingforward.com — type: xmlrpc_attempts
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-28 22:17:32
(5 hours ago)
(mod_security) mod_security (id:240335) triggered by 40.160.67.166 (ns1027448.ip-40-160-67.us): 1 in ...
show more
(mod_security) mod_security (id:240335) triggered by 40.160.67.166 (ns1027448.ip-40-160-67.us): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 18:17:26.916764 2026] [security2:error] [pid 14638:tid 14638] [client 40.160.67.166:43850] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 40.160.67.166 (+1 hits since last alert)|fattoria-rendena.it|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "fattoria-rendena.it"] [uri "/xmlrpc.php"] [unique_id "akGddv3tDstESoKe3Hap3QAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
inlink.ltd
2026-06-28 22:05:31
(5 hours ago)
Known malicious PHP file or CMS probe
Web App Attack
🇺🇸
TPI-Abuse
2026-06-28 17:05:22
(10 hours ago)
(mod_security) mod_security (id:240335) triggered by 40.160.67.166 (ns1027448.ip-40-160-67.us): 1 in ...
show more
(mod_security) mod_security (id:240335) triggered by 40.160.67.166 (ns1027448.ip-40-160-67.us): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 13:05:18.951600 2026] [security2:error] [pid 17340:tid 17340] [client 40.160.67.166:54838] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 40.160.67.166 (+1 hits since last alert)|theamarals.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "theamarals.com"] [uri "/xmlrpc.php"] [unique_id "akFUTvnBGQgKdf5DMSZu-wAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
applemooz
2026-06-28 12:15:54
(15 hours ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
2026-06-28 10:44:21
(17 hours ago)
Bad Web Bot
Web App Attack
🇪🇸
masterguru
2026-06-28 09:41:54
(18 hours ago)
(xmlrpc) Failed xmlrpc access from 40.160.67.166 (US/United States/ns1027448.ip-40-160-67.us): 5 in ...
show more
(xmlrpc) Failed xmlrpc access from 40.160.67.166 (US/United States/ns1027448.ip-40-160-67.us): 5 in the last 3600 secs (0-122)
show less
Hacking
🇩🇪
ger-stg-sifi1
2026-06-28 08:08:36
(19 hours ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
cwytech
2026-06-28 02:51:28
(1 day ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-xmlrpc-bf-high.
Bad Web Bot
Web App Attack
2026-06-28 02:19:03
(1 day ago)
Fail2ban filtered
...
Web App Attack
🇺🇸
TPI-Abuse
2026-06-27 18:27:05
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 40.160.67.166 (ns1027448.ip-40-160-67.us): 1 in ...
show more
(mod_security) mod_security (id:240335) triggered by 40.160.67.166 (ns1027448.ip-40-160-67.us): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 14:27:01.602837 2026] [security2:error] [pid 6880:tid 6880] [client 40.160.67.166:48504] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 40.160.67.166 (+1 hits since last alert)|oakvillenaturopathicclinic.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "oakvillenaturopathicclinic.com"] [uri "/xmlrpc.php"] [unique_id "akAV9efn8cWRK13sP5P0HwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack