🇩🇪
4server
2026-07-23 15:57:17
(13 hours ago)
[ThuJul2317:57:08.2213362026][security2:error][pid1882231:tid1882403][client49.37.42.220:0]ModSecuri ...
show more
[ThuJul2317:57:08.2213362026][security2:error][pid1882231:tid1882403][client49.37.42.220:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"maxay.ch\"][uri\"/xmlrpc.php\"][unique_id\"amI51DIzxvhS7ikQKNeNDQAAABE\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-23 12:38:19
(16 hours ago)
(mod_security) mod_security (id:225170) triggered by 49.37.42.220 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 49.37.42.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 08:38:08.726477 2026] [security2:error] [pid 3909043:tid 3909043] [client 49.37.42.220:62525] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||eta-mct.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "eta-mct.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amILMFz7vJL83iRtskUqbwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-23 09:02:03
(20 hours ago)
[redacted] 49.37.42.220 - - [23/Jul/2026:11:01:02 +0200] "POST /xmlrpc.php HTTP/1.1" 200 460 "-" "Mo ...
show more
[redacted] 49.37.42.220 - - [23/Jul/2026:11:01:02 +0200] "POST /xmlrpc.php HTTP/1.1" 200 460 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/94.0.0.0 Safari/537.36"
[redacted] 49.37.42.220 - - [23/Jul/2026:11:01:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 460 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/87.0.0.0 Safari/537.36"
[redacted] 49.37.42.220 - - [23/Jul/2026:11:01:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 460 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/15.0.0.0 Safari/537.36"
[redacted] 49.37.42.220 - - [23/Jul/2026:11:01:25 +0200] "POST /xmlrpc.php HTTP/1.1" 200 460 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36"
[redacted] 49.37.42.220 - - [23/Jul/2026:11:01:34 +0200] "POST /xmlrpc.php HTTP/1.1" 200 460 "-" "Mozilla/5.0 (
...
show less
Hacking
Web App Attack
🇩🇪
big-cloud.nl
2026-07-22 21:12:00
(1 day ago)
Try to access /xmlrpc.php
Web App Attack
🇳🇱
Site.eu
2026-07-22 18:43:12
(1 day ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇳🇱
Site.eu
2026-07-21 15:52:53
(2 days ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
2026-07-21 14:46:45
(2 days ago)
[redacted] 49.37.42.220 - - [21/Jul/2026:16:45:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mo ...
show more
[redacted] 49.37.42.220 - - [21/Jul/2026:16:45:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.0.0 Safari/537.36"
[redacted] 49.37.42.220 - - [21/Jul/2026:16:45:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/80.0.0.0 Safari/537.36"
[redacted] 49.37.42.220 - - [21/Jul/2026:16:46:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/99.0.0.0 Safari/537.36"
[redacted] 49.37.42.220 - - [21/Jul/2026:16:46:07 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/99.0.0.0 Safari/537.36"
[redacted] 49.37.42.220 - - [21/Jul/2026:16:46:16 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/70
...
show less
Hacking
Web App Attack
2026-07-21 07:11:19
(2 days ago)
[redacted] 49.37.42.220 - - [21/Jul/2026:09:10:08 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mo ...
show more
[redacted] 49.37.42.220 - - [21/Jul/2026:09:10:08 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/80.0.0.0 Safari/537.36"
[redacted] 49.37.42.220 - - [21/Jul/2026:09:10:08 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/12.0.0.0 Safari/537.36"
[redacted] 49.37.42.220 - - [21/Jul/2026:09:10:09 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/87.0.0.0 Safari/537.36"
[redacted] 49.37.42.220 - - [21/Jul/2026:09:10:41 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/13.0.0.0 Safari/537.36"
[redacted] 49.37.42.220 - - [21/Jul/2026:09:10:42 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/85
...
show less
Hacking
Web App Attack
🇹🇼
ip4.tw
2026-07-20 18:57:01
(3 days ago)
Malicious web scan
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-07-20 17:48:14
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 49.37.42.220 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 49.37.42.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 13:48:04.192225 2026] [security2:error] [pid 20314:tid 20349] [client 49.37.42.220:51324] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||grupojdg.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "grupojdg.com"] [uri "/wp-json/wp/v2/users"] [unique_id "al5fVMVsCWbB7fI0sn2iOwAAAE0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-19 20:46:36
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 49.37.42.220 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 49.37.42.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 16:46:25.997812 2026] [security2:error] [pid 5967:tid 5967] [client 49.37.42.220:64434] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||drjasonkolber.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "drjasonkolber.com"] [uri "/wp-json/wp/v2/users"] [unique_id "al03oWzNPdCDEwqFsKyMkwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-19 17:01:14
(4 days ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-07-19 15:10:35
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 49.37.42.220 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 49.37.42.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 11:10:23.632258 2026] [security2:error] [pid 1756166:tid 1756166] [client 49.37.42.220:58798] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||hawaiivacations.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hawaiivacations.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alzo34XMelcGHdKQsB4QmwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-07-19 14:51:57
(4 days ago)
[SunJul1916:51:50.6592832026][security2:error][pid1519472:tid1519821][client49.37.42.220:0]ModSecuri ...
show more
[SunJul1916:51:50.6592832026][security2:error][pid1519472:tid1519821][client49.37.42.220:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"giuristifriburgo.ch\"][uri\"/xmlrpc.php\"][unique_id\"alzkhpVbAIZU1vql69MrMgAAAJE\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-07-19 11:37:47
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 49.37.42.220 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 49.37.42.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 07:37:35.608107 2026] [security2:error] [pid 19059:tid 19059] [client 49.37.42.220:57076] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||caddydad.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "caddydad.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aly2_wzR9z6F0Tr-6DR1ZAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack