2026-06-16 01:38:06
(1 hour ago)
41.174.98.95 - - [16/Jun/2026:03:37:48 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by Wo ...
show more
41.174.98.95 - - [16/Jun/2026:03:37:48 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com"
41.174.98.95 - - [16/Jun/2026:03:37:50 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com"
41.174.98.95 - - [16/Jun/2026:03:37:55 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "WordPress.com; https://wordpress.com"
41.174.98.95 - - [16/Jun/2026:03:37:56 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "WordPress.com; https://wordpress.com"
41.174.98.95 - - [16/Jun/2026:03:38:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.1)"
...
show less
Brute-Force
Web App Attack
🇩🇪
rh24
2026-06-15 10:43:54
(16 hours ago)
(wordpress) Failed wordpress login from 41.174.98.95 (ZW/Zimbabwe/-): (CF_ENABLE)
Brute-Force
2026-06-15 02:47:55
(1 day ago)
[ns41.kdns.gr] httpd-xmlrpc-post: sites=medisto.gr; logs=/var/log/httpd/domains/medisto.gr.log; samp ...
show more
[ns41.kdns.gr] httpd-xmlrpc-post: sites=medisto.gr; logs=/var/log/httpd/domains/medisto.gr.log; samples=/xmlrpc.php
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 19:35:33
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 15:35:25.539968 2026] [security2:error] [pid 7248:tid 7248] [client 41.174.98.95:57539] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 41.174.98.95 (+1 hits since last alert)|bonesband.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "bonesband.com"] [uri "/xmlrpc.php"] [unique_id "ai8CfVF_IbG18lpTTKvFSwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 17:53:34
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 13:53:27.410944 2026] [security2:error] [pid 11238:tid 11238] [client 41.174.98.95:56700] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 41.174.98.95 (+1 hits since last alert)|monmouthcountydanceclasses.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "monmouthcountydanceclasses.com"] [uri "/xmlrpc.php"] [unique_id "ai7ql4_EdKmy2FKC9NMoPQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-06-14 17:33:05
(1 day ago)
trying wp-login.php/xmlrpc.php 34 times in 1 minutes
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 15:38:25
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 11:38:19.737997 2026] [security2:error] [pid 11276:tid 11290] [client 41.174.98.95:58994] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 41.174.98.95 (+1 hits since last alert)|eliteproductions.tv|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "eliteproductions.tv"] [uri "/xmlrpc.php"] [unique_id "ai7K63fO9XDHQpvaSedcGAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 15:05:39
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 11:05:31.743480 2026] [security2:error] [pid 27656:tid 27656] [client 41.174.98.95:64149] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 41.174.98.95 (+1 hits since last alert)|americanacademyofteachersofsinging.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "americanacademyofteachersofsinging.org"] [uri "/xmlrpc.php"] [unique_id "ai7DO5U_7csOY3u5mmaO3gAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 11:19:34
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 07:19:26.166893 2026] [security2:error] [pid 15658:tid 15658] [client 41.174.98.95:50257] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 41.174.98.95 (+1 hits since last alert)|yanlidesign.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "yanlidesign.com"] [uri "/xmlrpc.php"] [unique_id "ai6OPnHVPBIamFu5ahhAWwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-14 10:18:10
(1 day ago)
Attac
Brute-Force
🇺🇸
TPI-Abuse
2026-06-14 08:16:08
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 04:16:01.443202 2026] [security2:error] [pid 25256:tid 25256] [client 41.174.98.95:56575] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 41.174.98.95 (+1 hits since last alert)|cbrtome.cl|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "cbrtome.cl"] [uri "/xmlrpc.php"] [unique_id "ai5jQR9Y_Khn7JxcM9SDQwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 06:15:08
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 02:15:02.405844 2026] [security2:error] [pid 13537:tid 13537] [client 41.174.98.95:65478] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 41.174.98.95 (+1 hits since last alert)|ideaofauniversity.website|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ideaofauniversity.website"] [uri "/xmlrpc.php"] [unique_id "ai5G5nO8_0rCeWOzWsfjcAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 05:12:27
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 41.174.98.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 01:12:23.329751 2026] [security2:error] [pid 17105:tid 17105] [client 41.174.98.95:54940] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 41.174.98.95 (+1 hits since last alert)|danielbrower.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "danielbrower.com"] [uri "/xmlrpc.php"] [unique_id "ai44N_K5yhDhOPE5cvwOngAAAHY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-12 21:38:10
(3 days ago)
Attac
Brute-Force
🇳🇱
Site.eu
2026-06-12 21:06:45
(3 days ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH