🇨🇭
4server
2026-07-22 20:15:11
(4 hours ago)
[WedJul2222:15:06.3217932026][security2:error][pid3929579:tid3929848][client81.184.72.248:0]ModSecur ...
show more
[WedJul2222:15:06.3217932026][security2:error][pid3929579:tid3929848][client81.184.72.248:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"flyingberber.com\"][uri\"/xmlrpc.php\"][unique_id\"amEkykLOYszjZHHOmsNMQwAAAUA\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-07-22 18:53:42
(5 hours ago)
(mod_security) mod_security (id:225170) triggered by 81.184.72.248 (81.184.72.248.dyn.user.ono.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 81.184.72.248 (81.184.72.248.dyn.user.ono.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 14:53:38.300268 2026] [security2:error] [pid 1305289:tid 1305289] [client 81.184.72.248:63518] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||desdier.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "desdier.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amERsiU9QHmWICgNoWw8NAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-22 17:24:26
(7 hours ago)
(mod_security) mod_security (id:225170) triggered by 81.184.72.248 (81.184.72.248.dyn.user.ono.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 81.184.72.248 (81.184.72.248.dyn.user.ono.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 13:24:20.603279 2026] [security2:error] [pid 2312817:tid 2312817] [client 81.184.72.248:58156] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||bosdkbook.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bosdkbook.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amD8xCjC5OVZ1gbCL3Fs1AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
masterguru
2026-07-22 10:28:48
(13 hours ago)
(xmlrpc) Failed xmlrpc access from 81.184.72.248 (ES/Spain/81.184.72.248.dyn.user.ono.com): 5 in the ...
show more
(xmlrpc) Failed xmlrpc access from 81.184.72.248 (ES/Spain/81.184.72.248.dyn.user.ono.com): 5 in the last 3600 secs (0-122)
show less
Hacking
🇺🇸
oralunal
2026-07-22 09:58:12
(14 hours ago)
IP banned by Fail2Ban in jail oral-suss access.log mvfnds
...
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-07-22 07:20:25
(17 hours ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
2026-07-22 07:10:30
(17 hours ago)
Fail2Ban: WordPress XML-RPC brute-force attack detected.
Bad Web Bot
Web App Attack
🇺🇸
mschimpf
2026-01-23 19:56:00
(5 months ago)
Web App Attack
🇩🇪
LRob
2026-01-23 17:35:16
(5 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-23 16:23:10
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 81.184.72.248 (81.184.72.248.dyn.user.ono.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 81.184.72.248 (81.184.72.248.dyn.user.ono.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 23 11:23:02.404510 2026] [security2:error] [pid 9164:tid 9164] [client 81.184.72.248:60962] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||iplayriichi.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "iplayriichi.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXOgZgQmBuXzuIyHof5iZwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-23 09:42:19
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 81.184.72.248 (81.184.72.248.dyn.user.ono.com): ...
show more
(mod_security) mod_security (id:225170) triggered by 81.184.72.248 (81.184.72.248.dyn.user.ono.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 23 04:42:11.764928 2026] [security2:error] [pid 29150:tid 29150] [client 81.184.72.248:56573] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||coyotebytes.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "coyotebytes.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXNCcxaoD24aFA9Gm0QPSwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Rey
2026-01-23 08:18:02
(5 months ago)
WordPress xmlrpc.php attack [sis34wjl]
Web App Attack
🇦🇹
nomzamo
2025-12-31 23:55:36
(6 months ago)
Fail2Ban reported: nginx-noscript
Brute-Force
Bad Web Bot
🇺🇸
Jason Howell
2025-12-31 22:19:49
(6 months ago)
81.184.72.248 - - [31/Dec/2025:16:05:53 -0600] "POST /xmlrpc.php HTTP/1.1" 200 2994 "-" "Mozilla/5.0 ...
show more
81.184.72.248 - - [31/Dec/2025:16:05:53 -0600] "POST /xmlrpc.php HTTP/1.1" 200 2994 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
81.184.72.248 - - [31/Dec/2025:16:16:55 -0600] "POST /xmlrpc.php HTTP/1.1" 200 2993 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
81.184.72.248 - - [31/Dec/2025:16:17:50 -0600] "POST /xmlrpc.php HTTP/1.1" 200 2994 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
81.184.72.248 - - [31/Dec/2025:16:18:47 -0600] "POST /xmlrpc.php HTTP/1.1" 200 2993 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
81.184.72.248 - - [31/Dec/2025:16:19:47 -0600] "POST /xmlrpc.php HTTP/1.1" 200 2992 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome
...
show less
Web App Attack
🇩🇪
R.G.
2025-12-31 18:00:34
(6 months ago)
(XMLRPCorWHATEVER) Get lost please 81.184.72.248 (81.184.72.248.dyn.user.ono.com): 3 in the last 900 ...
show more
(XMLRPCorWHATEVER) Get lost please 81.184.72.248 (81.184.72.248.dyn.user.ono.com): 3 in the last 900 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack