🇩🇪
4server
2026-07-02 23:16:56
(13 hours ago)
[FriJul0301:16:54.5377032026][security2:error][pid3588215:tid3588251][client52.161.46.112:0]ModSecur ...
show more
[FriJul0301:16:54.5377032026][security2:error][pid3588215:tid3588251][client52.161.46.112:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"giftech.ch\"][uri\"/xmlrpc.php\"][unique_id\"akbxZgOGdfM7KdLIZsjCYAAAABM\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 22:53:40
(13 hours ago)
(mod_security) mod_security (id:225170) triggered by 52.161.46.112 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 52.161.46.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 18:53:35.125688 2026] [security2:error] [pid 12445:tid 12445] [client 52.161.46.112:8883] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gormish.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gormish.org"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbr70UNhOVvEt17fMrfWQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-02 22:37:31
(14 hours ago)
52.161.46.112 - - [03/Jul/2026:00:37:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 1075 "-" "Mozilla/5.0 ...
show more
52.161.46.112 - - [03/Jul/2026:00:37:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 1075 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0"
52.161.46.112 - - [03/Jul/2026:00:37:26 +0200] "POST /xmlrpc.php HTTP/1.1" 200 656 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0"
52.161.46.112 - - [03/Jul/2026:00:37:26 +0200] "POST /xmlrpc.php HTTP/1.1" 200 625 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15"
52.161.46.112 - - [03/Jul/2026:00:37:29 +0200] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15"
52.161.46.112 - - [03/Jul/2026:00:37:29 +0200] "POST /xmlrpc.php HTTP/1.1" 200 625 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 22:21:24
(14 hours ago)
(mod_security) mod_security (id:225170) triggered by 52.161.46.112 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 52.161.46.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 18:21:19.081723 2026] [security2:error] [pid 15667:tid 15667] [client 52.161.46.112:8788] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||shellyfamily.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "shellyfamily.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbkXyWWu3Xuo9a1XM9tVgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Vegascosmetics
2026-07-02 22:02:18
(14 hours ago)
(Kingcopy.org-AI-IDS-Report):IP automatically blocked after attack pattern. Vegas Security
DDoS Attack
Hacking
Exploited Host
🇫🇷
tecnicorioja
2026-07-02 22:00:14
(14 hours ago)
POST /xmlrpc.php [02/Jul/2026:03:27:21
Brute-Force
Web App Attack
🇺🇸
Penny Packer
2026-07-02 21:51:33
(14 hours ago)
Fail2Ban apache-tripwires
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 21:37:23
(15 hours ago)
(mod_security) mod_security (id:225170) triggered by 52.161.46.112 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 52.161.46.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 17:37:18.823026 2026] [security2:error] [pid 3607:tid 3607] [client 52.161.46.112:8258] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jeremy-olson.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jeremy-olson.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbaDtM7CgtwEqSMDtgPNAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-02 21:10:05
(15 hours ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇩🇪
Selckie
2026-07-02 21:08:31
(15 hours ago)
fail2ban: NGINX unusual impact
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 21:05:00
(15 hours ago)
(mod_security) mod_security (id:225170) triggered by 52.161.46.112 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 52.161.46.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 17:04:56.679110 2026] [security2:error] [pid 31141:tid 31141] [client 52.161.46.112:9108] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||wetlizarddiveteam.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "wetlizarddiveteam.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbSeL2v_lowkJUoFW5uswAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇷
setupgr
2026-07-02 21:02:34
(15 hours ago)
(XMLRPC) WP XMLRPC Attack 52.161.46.112 (US/United States/Wyoming/Cheyenne/-/[AS8075 MICROSOFT-CORP- ...
show more
(XMLRPC) WP XMLRPC Attack 52.161.46.112 (US/United States/Wyoming/Cheyenne/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 52.161.46.112 - - [03/Jul/2026:00:01:55 +0300] "GET /xmlrpc.php HTTP/1.1" 503 7310 "https://doityourself.gr/xmlrpc.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-07-02 20:46:31
(16 hours ago)
(mod_security) mod_security (id:225170) triggered by 52.161.46.112 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 52.161.46.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 16:46:24.548798 2026] [security2:error] [pid 10667:tid 10667] [client 52.161.46.112:8039] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ultratecnologia.com.mx|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ultratecnologia.com.mx"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbOILfXeodYrfXb9oqEsAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇾
lns.bz
2026-07-02 20:28:07
(16 hours ago)
Banned for trying to access xmlrpc [BY]
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 20:25:47
(16 hours ago)
(mod_security) mod_security (id:225170) triggered by 52.161.46.112 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 52.161.46.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 16:25:43.046842 2026] [security2:error] [pid 27631:tid 27631] [client 52.161.46.112:8155] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ecrecorp.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ecrecorp.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbJR419KgpIB_HevuGBIgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack