2026-09-22 03:13:03
(9 hours ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
2026-09-22 01:24:18
(11 hours ago)
Blocked by web application firewall: automated malicious HTTP requests (WordPress xmlrpc.php / wp-lo ...
show more
Blocked by web application firewall: automated malicious HTTP requests (WordPress xmlrpc.php / wp-login brute-force and admin-panel scanning). Distributed botnet / automated tooling. No legitimate use.
show less
Brute-Force
Web App Attack
2026-09-21 16:55:07
(19 hours ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
2026-09-21 15:35:48
(21 hours ago)
WordPress Brute Force
Brute-Force
🇺🇸
lcpacs
2026-09-21 13:50:42
(22 hours ago)
Auto-flagged by honeypot: tripped /xmlrpc.php — client-supplied proxy headers (x-forwarded-proto:htt ...
show more
Auto-flagged by honeypot: tripped /xmlrpc.php — client-supplied proxy headers (x-forwarded-proto:http) — not US+en-US (country: FR, accept-language: none)
show less
Bad Web Bot
Web App Attack
🇮🇹
LTM
2026-09-21 06:20:01
(1 day ago)
WebServer - Attempts to exploit
Hacking
Brute-Force
Web App Attack
2026-09-20 23:00:22
(1 day ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 18:56:46
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 51.158.30.100 (vm2.abvsm.com): 1 in the last 30 ...
show more
(mod_security) mod_security (id:225170) triggered by 51.158.30.100 (vm2.abvsm.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 14:56:40.683395 2026] [security2:error] [pid 27764:tid 27764] [client 51.158.30.100:41778] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.taekwondoit.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.taekwondoit.com"] [uri "/about-us/wp-json/wp/v2/users"] [unique_id "arAsaF378D1404bj42V5DwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇽
octageeks.com
2026-09-20 04:16:30
(2 days ago)
Wordpress malicious attack:[octawpauthor]
Web App Attack
🇺🇸
TPI-Abuse
2026-09-19 18:40:45
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 51.158.30.100 (vm2.abvsm.com): 1 in the last 30 ...
show more
(mod_security) mod_security (id:225170) triggered by 51.158.30.100 (vm2.abvsm.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 14:40:41.812135 2026] [security2:error] [pid 11186:tid 11186] [client 51.158.30.100:43550] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||talkingmess.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "talkingmess.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aq7XKZ_gyY0PKq5gIoaQvQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
antlac1
2026-09-19 18:12:41
(2 days ago)
crowdsecurity/http-wordpress_user-enum
Brute-Force
Web App Attack
2026-09-19 17:17:30
(2 days ago)
2026-09-19T19:17:19.983540+02:00 wordpress(www.klopf-kongress.de)[186897]: Blocked user enumeration ...
show more
2026-09-19T19:17:19.983540+02:00 wordpress(www.klopf-kongress.de)[186897]: Blocked user enumeration attempt from 51.158.30.100
show less
Web Spam
Blog Spam
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-19 16:53:40
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 51.158.30.100 (vm2.abvsm.com): 1 in the last 30 ...
show more
(mod_security) mod_security (id:225170) triggered by 51.158.30.100 (vm2.abvsm.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 12:53:32.239365 2026] [security2:error] [pid 4566:tid 4566] [client 51.158.30.100:36386] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||westernmassaa.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "westernmassaa.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aq6-DEeeX10TWF45T-yIbwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-19 15:12:09
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 51.158.30.100 (vm2.abvsm.com): 1 in the last 30 ...
show more
(mod_security) mod_security (id:225170) triggered by 51.158.30.100 (vm2.abvsm.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 11:12:03.220377 2026] [security2:error] [pid 26333:tid 26333] [client 51.158.30.100:52628] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bethanpearce.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bethanpearce.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aq6mQwir_O9Fl1eluc6joAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-19 14:32:37
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 51.158.30.100 (vm2.abvsm.com): 1 in the last 30 ...
show more
(mod_security) mod_security (id:225170) triggered by 51.158.30.100 (vm2.abvsm.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 10:32:33.483962 2026] [security2:error] [pid 19609:tid 19609] [client 51.158.30.100:33710] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.feiz.church|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.feiz.church"] [uri "/wp-json/wp/v2/users"] [unique_id "aq6dAStLXpw_rnDqw2G_tAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
