🇩🇪
FD-IX
2026-09-04 15:31:07
UTC ·
(2 months ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
Anonymous
2026-09-04 11:15:56
UTC ·
(2 months ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
IndigoRidge
2026-09-04 06:29:16
UTC ·
(2 months ago)
49.36.81.34 - - [04/Sep/2026:02:27:26 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5042 "-" "WordPress.com; https://wordpress.com"
49.36.81.34 - - [04/Sep/2026:02:27:59 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5042 "-" "WordPress.com; https://wordpress.com"
...
show more
49.36.81.34 - - [04/Sep/2026:02:27:26 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5042 "-" "WordPress.com; https://wordpress.com"
49.36.81.34 - - [04/Sep/2026:02:27:59 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5042 "-" "WordPress.com; https://wordpress.com"
49.36.81.34 - - [04/Sep/2026:02:28:31 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5042 "-" "WordPress.com; https://wordpress.com"
49.36.81.34 - - [04/Sep/2026:02:29:03 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5042 "-" "WordPress.com; https://wordpress.com"
49.36.81.34 - - [04/Sep/2026:02:29:13 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5042 "-" "WordPress.com; https://wordpress.com"
...
show less
Web App Attack
🇳🇱
i-turnradio.nl
2026-08-30 11:23:32
UTC ·
(2 months ago)
2026-08-30 @ 13:23:32 (CET) ~ Blocked for trying to access: /xmlrpc.php
Web App Attack
🇲🇾
Rizzy
2026-08-17 15:04:11
UTC ·
(2 months ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
IndigoRidge
2026-08-17 13:50:48
UTC ·
(2 months ago)
49.36.81.34 - - [17/Aug/2026:09:46:51 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5263 "-" "WordPress.com; https://wordpress.com"
49.36.81.34 - - [17/Aug/2026:09:50:04 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5263 "-" "WordPress.com; https://wordpress.com"
...
show more
49.36.81.34 - - [17/Aug/2026:09:46:51 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5263 "-" "WordPress.com; https://wordpress.com"
49.36.81.34 - - [17/Aug/2026:09:50:04 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5263 "-" "WordPress.com; https://wordpress.com"
49.36.81.34 - - [17/Aug/2026:09:50:25 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5263 "-" "WordPress.com; https://wordpress.com"
49.36.81.34 - - [17/Aug/2026:09:50:36 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5263 "-" "WordPress.com; https://wordpress.com"
49.36.81.34 - - [17/Aug/2026:09:50:47 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5263 "-" "WordPress.com; https://wordpress.com"
...
show less
Web App Attack
🇩🇪
rh24
2026-08-17 09:38:19
UTC ·
(2 months ago)
(xmlrpc_405) XMLRPC-Bot 405 49.36.81.34 (IN/India/-)
Hacking
🇩🇪
LRob
2026-08-17 07:48:20
UTC ·
(2 months ago)
WordPress probing | req: /xmlrpc.php | UA: Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/61.0.0.0 Safari/537.36
Brute-Force
Web App Attack
Anonymous
2026-07-29 07:00:00
UTC ·
(3 months ago)
Apache probe; attempts=42; exact paths: /xmlrpc.php
Web App Attack
Anonymous
2026-07-25 12:53:03
UTC ·
(3 months ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
Anonymous
2026-07-25 09:49:36
UTC ·
(3 months ago)
[ssd1.kdns.gr] httpd-xmlrpc-post: sites=www.filoixenofontos.gr; logs=/var/log/httpd/domains/filoixenofontos.gr.log; samples=/xmlrpc.php
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-25 08:42:51
UTC ·
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 49.36.81.34 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 04:42:39.047271 2026] [security2:error] [pid 1991657:tid 1991657] [client 49.36.81.34:60394] M ...
show more
(mod_security) mod_security (id:240335) triggered by 49.36.81.34 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 04:42:39.047271 2026] [security2:error] [pid 1991657:tid 1991657] [client 49.36.81.34:60394] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 49.36.81.34 (+1 hits since last alert)|idmadventures.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "idmadventures.com"] [uri "/xmlrpc.php"] [unique_id "amR2_yiDINTVMBMmhGCgtgAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-07-25 05:50:28
UTC ·
(3 months ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-07-25 05:25:50
UTC ·
(3 months ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
Anonymous
2026-07-24 09:50:41
UTC ·
(3 months ago)
[redacted] 49.36.81.34 - - [24/Jul/2026:11:50:35 +0200] "POST /xmlrpc.php HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/100.0.0.0 Safari/537.36"
[redacted] 49.36.81.34 - - [24/Jul/2026:11:50 ...
show more
[redacted] 49.36.81.34 - - [24/Jul/2026:11:50:35 +0200] "POST /xmlrpc.php HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/100.0.0.0 Safari/537.36"
[redacted] 49.36.81.34 - - [24/Jul/2026:11:50:38 +0200] "POST /xmlrpc.php HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Windows NT 10.0; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/12.0.0.0 Safari/537.36"
[redacted] 49.36.81.34 - - [24/Jul/2026:11:50:38 +0200] "POST /xmlrpc.php HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/95.0.0.0 Safari/537.36"
[redacted] 49.36.81.34 - - [24/Jul/2026:11:50:39 +0200] "POST /xmlrpc.php HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.0.0 Safari/537.36"
[redacted] 49.36.81.34 - - [24/Jul/2026:11:50:40 +0200] "POST /xmlrpc.php HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.0.0 Safari/
...
show less
Hacking
Web App Attack