🇫🇮
as211431.net
2026-06-02 18:33:53
(1 day ago)
Triggered Cloudflare WAF (firewallCustom) from IQ.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 ...
show more
Triggered Cloudflare WAF (firewallCustom) from IQ.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 (POST method)
Endpoint: /xmlrpc.php
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-02 18:32:38
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 45.157.54.9 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 45.157.54.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 14:32:22.851251 2026] [security2:error] [pid 7713:tid 7713] [client 45.157.54.9:27530] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 45.157.54.9 (+1 hits since last alert)|www.premierveterinarysurgery.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.premierveterinarysurgery.com"] [uri "/xmlrpc.php"] [unique_id "ah8hti2CguUR-hRLpBubqwAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-02 18:24:40
(1 day ago)
Attac
Brute-Force
🇮🇩
soc-yk
2026-06-02 18:18:16
(1 day ago)
Type: suspicious_network_activity
Risk: 87
Events: 20
Evidence:
- Persistent suspicious network act ...
show more
Type: suspicious_network_activity
Risk: 87
Events: 20
Evidence:
- Persistent suspicious network activity detected
- Repeated hostile operational behavior observed
- Threat escalation behavior observed
show less
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-06-02 18:15:00
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 45.157.54.9 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 45.157.54.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 14:14:55.878351 2026] [security2:error] [pid 32231:tid 32231] [client 45.157.54.9:56025] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 45.157.54.9 (+1 hits since last alert)|onevoicefoundationlb.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "onevoicefoundationlb.org"] [uri "/xmlrpc.php"] [unique_id "ah8dnz44EnPoerpPlCMAzAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob.fr
2026-06-02 18:00:08
(1 day ago)
Repeated attacks detected by Fail2Ban in recidive jail
Hacking
🇫🇷
Yepngo
2026-06-02 17:55:02
(1 day ago)
45.157.54.9 - - [02/Jun/2026:19:54:45 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Mozilla/5.0 (W ...
show more
45.157.54.9 - - [02/Jun/2026:19:54:45 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
45.157.54.9 - - [02/Jun/2026:19:55:02 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
...
show less
Brute-Force
Web App Attack
2026-06-02 17:52:53
(1 day ago)
45.157.54.9 - - [02/Jun/2026:17:52:51 +0000] "POST /xmlrpc.php HTTP/2.0" 404 244309 "-" "Mozilla/5.0 ...
show more
45.157.54.9 - - [02/Jun/2026:17:52:51 +0000] "POST /xmlrpc.php HTTP/2.0" 404 244309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇷🇺
homeodor
2026-06-02 17:43:56
(1 day ago)
Automated scanner detected.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 17:43:54
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 45.157.54.9 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 45.157.54.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 13:43:46.847171 2026] [security2:error] [pid 4300:tid 4300] [client 45.157.54.9:33374] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 45.157.54.9 (+1 hits since last alert)|www.mfleetservice.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.mfleetservice.com"] [uri "/xmlrpc.php"] [unique_id "ah8WUpXJ8WVeC8ut5kQiHwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇭🇺
bcsaba
2026-06-02 17:43:14
(1 day ago)
Repeated request on blocked xmlrpc.php.
45.157.54.9 - - [02/Jun/2026:19:43:12 +0200] "POST /xmlrpc.p ...
show more
Repeated request on blocked xmlrpc.php.
45.157.54.9 - - [02/Jun/2026:19:43:12 +0200] "POST /xmlrpc.php HTTP/2.0" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 17:24:35
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 45.157.54.9 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 45.157.54.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 13:24:31.658698 2026] [security2:error] [pid 18270:tid 18415] [client 45.157.54.9:43625] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 45.157.54.9 (+1 hits since last alert)|www.dcmproductionsgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.dcmproductionsgroup.com"] [uri "/xmlrpc.php"] [unique_id "ah8Rz_bbZROOXDwJsq8gsAAAAFA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Prodscape
2026-06-02 17:24:25
(1 day ago)
(XMLRPC) WP XMLPRC Attack 45.157.54.9 (IQ/Iraq/-): 5 in the last 86400 secs; Ports: *; Direction: in ...
show more
(XMLRPC) WP XMLPRC Attack 45.157.54.9 (IQ/Iraq/-): 5 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER
show less
Port Scan
🇺🇸
TPI-Abuse
2026-06-02 17:06:53
(1 day ago)
(mod_security) mod_security (id:240335) triggered by 45.157.54.9 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 45.157.54.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 13:06:46.066414 2026] [security2:error] [pid 2478:tid 2478] [client 45.157.54.9:10416] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 45.157.54.9 (+1 hits since last alert)|newmooncafe.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "newmooncafe.com"] [uri "/xmlrpc.php"] [unique_id "ah8NptUvN_l14TnLSNtJHgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
RH5
2026-06-02 16:56:07
(1 day ago)
Restricted URL probing (/xmlrpc.php) (UTC 2026-06-02 16:56)
Web App Attack