🇩🇪
Elygor77
2026-07-24 06:52:03
(2 hours ago)
WordPress xmlrpc.php brute-force: 20 malicious requests observed (auto-report via server-monitor).
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-23 06:56:59
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 41.59.15.202 (202.15-59-41.o-s-w-p.ttcldata.net ...
show more
(mod_security) mod_security (id:240335) triggered by 41.59.15.202 (202.15-59-41.o-s-w-p.ttcldata.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 02:56:53.506799 2026] [security2:error] [pid 3771136:tid 3771136] [client 41.59.15.202:57174] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 41.59.15.202 (+1 hits since last alert)|starsmogsandiego.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "starsmogsandiego.com"] [uri "/xmlrpc.php"] [unique_id "amG7NRe1d-vEU-oS0AIcJwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
IndigoRidge
2026-07-22 17:55:18
(1 day ago)
41.59.15.202 - - [22/Jul/2026:13:54:03 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5533 "-" "WordPress.co ...
show more
41.59.15.202 - - [22/Jul/2026:13:54:03 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5533 "-" "WordPress.com; https://wordpress.com"
41.59.15.202 - - [22/Jul/2026:13:54:24 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5533 "-" "WordPress.com; https://wordpress.com"
41.59.15.202 - - [22/Jul/2026:13:54:46 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5533 "-" "WordPress.com; https://wordpress.com"
41.59.15.202 - - [22/Jul/2026:13:55:07 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5533 "-" "WordPress.com; https://wordpress.com"
41.59.15.202 - - [22/Jul/2026:13:55:17 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5533 "-" "WordPress.com; https://wordpress.com"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-07-22 17:54:36
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 41.59.15.202 (202.15-59-41.o-s-w-p.ttcldata.net ...
show more
(mod_security) mod_security (id:240335) triggered by 41.59.15.202 (202.15-59-41.o-s-w-p.ttcldata.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 13:54:28.355132 2026] [security2:error] [pid 1214432:tid 1214432] [client 41.59.15.202:56495] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 41.59.15.202 (+1 hits since last alert)|bigholegolf.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "bigholegolf.com"] [uri "/xmlrpc.php"] [unique_id "amED1F_gqknlXVB2ZxTj9QAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-22 17:19:21
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 41.59.15.202 (202.15-59-41.o-s-w-p.ttcldata.net ...
show more
(mod_security) mod_security (id:240335) triggered by 41.59.15.202 (202.15-59-41.o-s-w-p.ttcldata.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 13:19:16.901874 2026] [security2:error] [pid 2328623:tid 2328623] [client 41.59.15.202:57724] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 41.59.15.202 (+1 hits since last alert)|equipoperu.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "equipoperu.org"] [uri "/xmlrpc.php"] [unique_id "amD7lEwFwerYiLLsQa3mEgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-07-22 13:25:24
(1 day ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇪🇸
alferez
2026-07-22 10:57:35
(1 day ago)
xmlrpc.php attack DOS
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-07-22 10:24:47
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 41.59.15.202 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:240335) triggered by 41.59.15.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 06:24:32.322619 2026] [security2:error] [pid 1384543:tid 1384543] [client 41.59.15.202:59698] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 41.59.15.202 (+1 hits since last alert)|nypatriotcards.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nypatriotcards.com"] [uri "/xmlrpc.php"] [unique_id "amCaYHQfy98xzBYiVKWVlAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-16 14:30:40
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 41.59.15.202 (202.15-59-41.o-s-w-p.ttcldata.net ...
show more
(mod_security) mod_security (id:240335) triggered by 41.59.15.202 (202.15-59-41.o-s-w-p.ttcldata.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 10:30:32.027465 2026] [security2:error] [pid 4727:tid 4856] [client 41.59.15.202:57912] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 41.59.15.202 (+1 hits since last alert)|dwcmachining.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "dwcmachining.com"] [uri "/xmlrpc.php"] [unique_id "aljrCLsWp_wVS366ffXnwgAAAhQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-16 14:01:45
(1 week ago)
[redacted] 41.59.15.202 - - [16/Jul/2026:16:00:39 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Je ...
show more
[redacted] 41.59.15.202 - - [16/Jul/2026:16:00:39 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 41.59.15.202 - - [16/Jul/2026:16:01:11 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 41.59.15.202 - - [16/Jul/2026:16:01:22 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)"
[redacted] 41.59.15.202 - - [16/Jul/2026:16:01:38 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 41.59.15.202 - - [16/Jul/2026:16:01:43 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.1; WordPress/6.4; http://site55128520.com"
...
show less
Hacking
Web App Attack