|
🇳🇴
jad-abuse
|
|
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 1 hits.
|
Brute-Force
Web App Attack
|
|
Anonymous
|
|
[redacted] 49.149.101.115 - - [07/Oct/2026:09:47:17 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.3)"
[redacted] 49.149.101.115 - - [07/Oct/2026:09:47:28 +0200] "POST /xmlrpc.php HTTP/1.1" 405 42 ...
show more
[redacted] 49.149.101.115 - - [07/Oct/2026:09:47:17 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.3)"
[redacted] 49.149.101.115 - - [07/Oct/2026:09:47:28 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 49.149.101.115 - - [07/Oct/2026:09:47:38 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 49.149.101.115 - - [07/Oct/2026:09:47:49 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 49.149.101.115 - - [07/Oct/2026:09:48:00 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.0; WordPress/6.1; http://site83406634.com"
...
show less
|
Hacking
Web App Attack
|
|
🇺🇸
IndigoRidge
|
|
49.149.101.115 - - [07/Oct/2026:01:45:23 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5132 "-" "WordPress.com; https://wordpress.com"
49.149.101.115 - - [07/Oct/2026:01:45:45 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5132 "-" "WordPress.com; https://wordpress ...
show more
49.149.101.115 - - [07/Oct/2026:01:45:23 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5132 "-" "WordPress.com; https://wordpress.com"
49.149.101.115 - - [07/Oct/2026:01:45:45 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5132 "-" "WordPress.com; https://wordpress.com"
49.149.101.115 - - [07/Oct/2026:01:48:15 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5132 "-" "WordPress.com; https://wordpress.com"
49.149.101.115 - - [07/Oct/2026:01:48:36 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5132 "-" "WordPress.com; https://wordpress.com"
49.149.101.115 - - [07/Oct/2026:01:49:08 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5132 "-" "WordPress.com; https://wordpress.com"
...
show less
|
Web App Attack
|
|
Anonymous
|
|
[redacted] 49.149.101.115 - - [07/Oct/2026:06:41:56 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack/12.0; WordPress/6.1; http://site11274849.com"
[redacted] 49.149.101.115 - - [07/Oct/2026:06:42:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 ...
show more
[redacted] 49.149.101.115 - - [07/Oct/2026:06:41:56 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack/12.0; WordPress/6.1; http://site11274849.com"
[redacted] 49.149.101.115 - - [07/Oct/2026:06:42:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.2)"
[redacted] 49.149.101.115 - - [07/Oct/2026:06:42:15 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "WordPress.com; https://wordpress.com"
[redacted] 49.149.101.115 - - [07/Oct/2026:06:42:26 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com"
[redacted] 49.149.101.115 - - [07/Oct/2026:06:42:38 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack/12.1; WordPress/6.4; http://site41435795.com"
...
show less
|
Hacking
Web App Attack
|
|
🇫🇷
tecnicorioja
|
|
POST /xmlrpc.php [02/Oct/2026:14:54:32
|
Brute-Force
Web App Attack
|
|
Anonymous
|
|
IP matched detection query 20 more in short time bad rqs.
|
Brute-Force
Web App Attack
Hacking
|
|
🇦🇺
rubixstudios
|
|
Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360
|
DDoS Attack
Brute-Force
Web App Attack
|
|
🇳🇱
Alt255
|
|
[cb-09al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 49.149.101.115 - - [27/Sep/2026:10:13:58 +0200] "POST /xmlrpc.php HTTP/1.1" 301 4387 "-" "WordPress.com; https://wordpress.com"
49.149.1 ...
show more
[cb-09al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 49.149.101.115 - - [27/Sep/2026:10:13:58 +0200] "POST /xmlrpc.php HTTP/1.1" 301 4387 "-" "WordPress.com; https://wordpress.com"
49.149.101.115 - - [27/Sep/2026:10:14:03 +0200] "POST /xmlrpc.php HTTP/1.1" 301 4386 "-" "Jetpack/12.1; WordPress/6.3; http://site81410825.com"
49.149.101.115 - - [27/Sep/2026:10:14:07 +0200] "POST /xmlrpc.php HTTP/1.1" 302 4284 "-" "WordPress.com; https://wordpress.com"
49.149.101.115 - - [27/Sep/2026:10:14:08 +0200] "POST /xmlrpc.php HTTP/1.1" 301 4386 "-" "WordPress.com; https://wordpress.com"
...
show less
|
Brute-Force
Web App Attack
|
|
🇩🇪
FD-IX
|
|
Fail2Ban: WordPress XML-RPC brute-force attack detected.
|
Bad Web Bot
Web App Attack
|
|
🇸🇪
ljo
|
|
49.149.101.115 - - [27/Sep/2026:09:06:20 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5268 "-" "Jetpack/12.1; WordPress/6.2; http://site18655531.com"
49.149.101.115 - - [27/Sep/2026:09:06:30 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5268 "-" "WordPress.com; h ...
show more
49.149.101.115 - - [27/Sep/2026:09:06:20 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5268 "-" "Jetpack/12.1; WordPress/6.2; http://site18655531.com"
49.149.101.115 - - [27/Sep/2026:09:06:30 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5268 "-" "WordPress.com; https://wordpress.com"
49.149.101.115 - - [27/Sep/2026:09:06:41 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5268 "-" "Jetpack by WordPress.com"
49.149.101.115 - - [27/Sep/2026:09:06:51 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5268 "-" "Jetpack by WordPress.com"
49.149.101.115 - - [27/Sep/2026:09:07:02 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5268 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.1)"
49.149.101.115 - - [27/Sep/2026:09:07:13 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5268 "-" "WordPress.com; https://wordpress.com"
49.149.101.115 - - [27/Sep/2026:09:07:23 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5268 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.2)"
49.149.101.115 - - [27/Sep/2026:09:07:34 +0200] "POST /xmlrpc.php HTTP/1.1"
...
show less
|
Web App Attack
|
|
Anonymous
|
|
[osotir.org] httpd-xmlrpc-post: sites=www.drasimas.gr; logs=/var/log/httpd/domains/drasimas.gr.log; samples=/xmlrpc.php
|
Brute-Force
Web App Attack
|
|
Anonymous
|
|
IP matched detection query 20 more in short time bad rqs.
|
Brute-Force
Web App Attack
Hacking
|
|
🇦🇺
screwlooseit.com.au
|
|
Blocked by CSF 13 firewall - Rule: XMLRPC
PH/Philippines/-
|
Web App Attack
|
|
🇩🇪
IP Analyzer
|
|
Unauthorized connection attempt from IP address 49.149.101.115 on Port 445(SMB)
|
Port Scan
|
|
🇩🇪
Invisiblemen
|
|
Unauthorized connection attempt from IP address 49.149.101.115 on Port 445(SMB)
|
Port Scan
|