61.140.95.48

Excessive probing of non-existent URLs

764 requests to /xmlrpc.php

GET /xmlrpc.php

Unauthorized connection attempt / Port scanning 61.140.95.48 [21/Apr/2024:13:43:27] "GET /xmlrpc.php HTTP/1.1"

Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER

(mod_security) mod_security (id:240335) triggered by 61.140.95.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 20 22:02:37.869435 2024] [security2:error] [pid 8783] [client 61.140.95.48:43042] [client 61.140 ... show more (mod_security) mod_security (id:240335) triggered by 61.140.95.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 20 22:02:37.869435 2024] [security2:error] [pid 8783] [client 61.140.95.48:43042] [client 61.140.95.48] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 61.140.95.48 (+1 hits since last alert)|www.badgerkelley.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.badgerkelley.com"] [uri "/xmlrpc.php"] [unique_id "ZiRzvTIc1CtEhwCbB3tVcgAAAAE"], referer: https://www.badgerkelley.com/xmlrpc.php show less

Bot / scanning and/or hacking attempts: done, streams: 0/1/1/0/0 (open/recv/resp/push/rst), GET /xmlrpc.php HTTP/1.1

(mod_security) mod_security (id:240335) triggered by 61.140.95.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 20 16:31:55.668050 2024] [security2:error] [pid 2739525] [client 61.140.95.48:41150] [client 61. ... show more (mod_security) mod_security (id:240335) triggered by 61.140.95.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 20 16:31:55.668050 2024] [security2:error] [pid 2739525] [client 61.140.95.48:41150] [client 61.140.95.48] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 61.140.95.48 (+1 hits since last alert)|pinebrookdesign.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pinebrookdesign.com"] [uri "/xmlrpc.php"] [unique_id "ZiQmO7sUzcS3wlPx4pXvngAAAAI"], referer: http://pinebrookdesign.com/xmlrpc.php show less

www.lnklnx.com:80 61.140.95.48 - - [20/Apr/2024:03:21:24 -0500] "GET /xmlrpc.php HTTP/1.1" 301 496 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0" ...

Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER

(mod_security) mod_security (id:240335) triggered by 61.140.95.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 19 18:46:51.473105 2024] [security2:error] [pid 19201] [client 61.140.95.48:42374] [client 61.14 ... show more (mod_security) mod_security (id:240335) triggered by 61.140.95.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 19 18:46:51.473105 2024] [security2:error] [pid 19201] [client 61.140.95.48:42374] [client 61.140.95.48] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 61.140.95.48 (+1 hits since last alert)|gacstoday.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "gacstoday.com"] [uri "/xmlrpc.php"] [unique_id "ZiL0W_icpWjuUlZQn7q7ggAAAAs"], referer: https://gacstoday.com/xmlrpc.php show less

Unauthorized login attempts [ wordpress-xmlrpc]