๐ง๐ช
cmbplf
2026-01-16 01:28:14
(7 months ago)
681 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot
๐ฉ๐ช
bescared
2026-01-15 22:04:51
(7 months ago)
F2B - Malicious activity detected. URL Probing.
Hacking
Bad Web Bot
Web App Attack
๐บ๐ธ
myagent.site
2026-01-15 21:38:59
(7 months ago)
Blocking for trying to access an exploit file: /xmlrpc.php
Hacking
๐ฌ๐ง
yvoictra
2025-12-26 16:32:28
(8 months ago)
78.134.46.76 - - [26/Dec/2025:17:27:25 +0100] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "Mozilla/5.0 ( ...
show more
78.134.46.76 - - [26/Dec/2025:17:27:25 +0100] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/76.0.0.0 Safari/537.36"
78.134.46.76 - - [26/Dec/2025:17:28:27 +0100] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/14.0.0.0 Safari/537.36"
78.134.46.76 - - [26/Dec/2025:17:29:27 +0100] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.0.0 Safari/537.36"
78.134.46.76 - - [26/Dec/2025:17:30:27 +0100] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/76.0.0.0 Safari/537.36"
78.134.46.76 - - [26/Dec/2025:17:31:26 +0100] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/80.0.0.0 Safari/537.36"
78.134.46.7
...
show less
Brute-Force
Web App Attack
๐ฌ๐ง
ISPLtd
2025-12-26 15:54:35
(8 months ago)
78.134.46.76 - - [26/Dec/2025:11:54:33 -0400] "POST /xmlrpc.php
78.134.46.76 - - [26/Dec/2025:11:54: ...
show more
78.134.46.76 - - [26/Dec/2025:11:54:33 -0400] "POST /xmlrpc.php
78.134.46.76 - - [26/Dec/2025:11:54:34 -0400] "GET /xmlrpc.php
...
show less
Hacking
Web App Attack
๐บ๐ธ
TPI-Abuse
2025-12-26 11:40:17
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 78.134.46.76 (78-134-46-76.dyn.eolo.it): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 78.134.46.76 (78-134-46-76.dyn.eolo.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 26 06:40:12.528848 2025] [security2:error] [pid 23023:tid 23023] [client 78.134.46.76:32081] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||majesticsolutions.co|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "majesticsolutions.co"] [uri "/wp-json/wp/v2/users"] [unique_id "aU50HBdeIp6XDig7NeDi7gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2025-12-25 15:58:45
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 78.134.46.76 (78-134-46-76.dyn.eolo.it): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 78.134.46.76 (78-134-46-76.dyn.eolo.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 25 10:58:41.613216 2025] [security2:error] [pid 2162:tid 2162] [client 78.134.46.76:31119] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||alafiariverrendezvous.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "alafiariverrendezvous.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aU1fMROBiuIZp4_KQPt5fAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2025-12-24 20:36:05
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 78.134.46.76 (78-134-46-76.dyn.eolo.it): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 78.134.46.76 (78-134-46-76.dyn.eolo.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 24 15:35:58.783175 2025] [security2:error] [pid 15247:tid 15247] [client 78.134.46.76:29224] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fusionrep.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fusionrep.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aUxOrvBJJRArdKk2u9NyyAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2025-12-24 14:57:50
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 78.134.46.76 (78-134-46-76.dyn.eolo.it): 1 in t ...
show more
(mod_security) mod_security (id:225170) triggered by 78.134.46.76 (78-134-46-76.dyn.eolo.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 24 09:57:47.456968 2025] [security2:error] [pid 14709:tid 14725] [client 78.134.46.76:28739] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||busybeerestaurant.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "busybeerestaurant.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aUv_a-zNFdipZBcOcPLAGwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2025-12-23 19:46:48
(8 months ago)
[redacted] 78.134.46.76 - - [23/Dec/2025:20:46:46 +0100] "POST /xmlrpc.php HTTP/1.1" 403 199 "-" "Mo ...
show more
[redacted] 78.134.46.76 - - [23/Dec/2025:20:46:46 +0100] "POST /xmlrpc.php HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/81.0.0.0 Safari/537.36"
[redacted] 78.134.46.76 - - [23/Dec/2025:20:46:47 +0100] "POST /xmlrpc.php HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/70.0.0.0 Safari/537.36"
[redacted] 78.134.46.76 - - [23/Dec/2025:20:46:47 +0100] "POST /xmlrpc.php HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/66.0.0.0 Safari/537.36"
[redacted] 78.134.46.76 - - [23/Dec/2025:20:46:48 +0100] "POST /xmlrpc.php HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/91.0.0.0 Safari/537.36"
[redacted] 78.134.46.76 - - [23/Dec/2025:20:46:48 +0100] "POST /xmlrpc.php HTTP/1.1" 403 199 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, li
...
show less
Hacking
Web App Attack
๐ฉ๐ช
LRob
2025-12-23 17:48:09
(8 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
Anonymous
2025-12-22 21:54:05
(8 months ago)
(wordpress) Failed wordpress login from 78.134.46.76 (IT/Italy/78-134-46-76.dyn.eolo.it)
Brute-Force
๐ง๐พ
lns.bz
2025-12-21 21:02:40
(8 months ago)
Banned for trying to access xmlrpc [BY]
Web App Attack
๐ฉ๐ช
kjaerulff
2025-12-21 16:09:00
(8 months ago)
Failed Wordpress login using xmlrpc.php (78-134-46-76.dyn.eolo.it)
Web App Attack
๐ฉ๐ช
stinpriza
2025-12-21 15:21:18
(8 months ago)
Web App Attack
Web App Attack