🇬🇧
consul.to
2026-10-03 19:30:46
UTC ·
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
findlab
2026-10-03 11:05:01
UTC ·
(1 month ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
Anonymous
2026-10-02 16:45:14
UTC ·
(1 month ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇳🇱
Alt255
2026-10-02 16:44:11
UTC ·
(1 month ago)
[ti-22al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 81.35.58.67 - - [02/Oct/2026:18:43:52 +0200] "POST /xmlrpc.php HTTP/1.1" 301 5834 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/53 ...
show more
[ti-22al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 81.35.58.67 - - [02/Oct/2026:18:43:52 +0200] "POST /xmlrpc.php HTTP/1.1" 301 5834 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/88.0.0.0 Safari/537.36"
81.35.58.67 - - [02/Oct/2026:18:43:53 +0200] "POST /xmlrpc.php HTTP/1.1" 405 671 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36"
81.35.58.67 - - [02/Oct/2026:18:43:53 +0200] "POST /xmlrpc.php HTTP/1.1" 301 5835 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/12.0.0.0 Safari/537.36"
81.35.58.67 - - [02/Oct/2026:18:43:55 +0200] "POST /xmlrpc.php HTTP/1.
...
show less
Brute-Force
Web App Attack
🇸🇬
securejdprop
2026-10-01 22:54:02
UTC ·
(1 month ago)
This IP was detected by CrowdSec triggering custom/vpatch-xmlrpc-abuse.
Hacking
Anonymous
2026-10-01 12:36:04
UTC ·
(1 month ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇳🇿
Tripwire
2026-10-01 11:27:14
UTC ·
(1 month ago)
Probing for Wordpress - /xmlrpc.php
Brute-Force
Web App Attack
🇨🇭
4server
2026-10-01 08:25:12
UTC ·
(1 month ago)
[ThuOct0110:25:06.6321042026][security2:error][pid3316932:tid3316993][client81.35.58.67:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"96 ...
show more
[ThuOct0110:25:06.6321042026][security2:error][pid3316932:tid3316993][client81.35.58.67:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"mio-ip.ch\"][uri\"/xmlrpc.php\"][unique_id\"ar4Y4sLGzfHkj7PNnGk6lgAAAIM\"]
show less
Hacking
Web App Attack
🇫🇷
Yepngo
2026-09-30 18:18:08
UTC ·
(1 month ago)
81.35.58.67 - - [30/Sep/2026:20:14:00 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36"
81.35.58.67 - - [30/Sep/2026:20:18:08 +0 ...
show more
81.35.58.67 - - [30/Sep/2026:20:14:00 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36"
81.35.58.67 - - [30/Sep/2026:20:18:08 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36"
...
show less
Brute-Force
Web App Attack
🇩🇪
big-cloud.nl
2026-09-30 06:35:30
UTC ·
(1 month ago)
Try to access /xmlrpc.php
Web App Attack
Anonymous
2026-09-28 18:58:36
UTC ·
(1 month ago)
81.35.58.67 - - [28/Sep/2026:20:58:36 +0200] "POST / HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/85.0.0.0 Safari/537.36"
Web App Attack
🇺🇸
IndigoRidge
2026-09-28 11:39:59
UTC ·
(1 month ago)
81.35.58.67 - - [28/Sep/2026:07:38:44 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5145 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/64.0.0.0 Safari/537.36"
81.35.58.67 - - [28/Sep/2026:07:39:04 -0400] "POST /xmlrp ...
show more
81.35.58.67 - - [28/Sep/2026:07:38:44 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5145 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/64.0.0.0 Safari/537.36"
81.35.58.67 - - [28/Sep/2026:07:39:04 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5145 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.0.0 Safari/537.36"
81.35.58.67 - - [28/Sep/2026:07:39:24 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5145 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/72.0.0.0 Safari/537.36"
81.35.58.67 - - [28/Sep/2026:07:39:44 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5145 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/82.0.0.0 Safari/537.36"
81.35.58.67 - - [28/Sep/2026:07:39:58 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5145 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/13.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇩🇪
Guardian
2026-09-27 02:35:54
UTC ·
(1 month ago)
Unauthorized connection attempt / Port scanning
81.35.58.67 [27/Sep/2026:04:35:54 +0200] "GET /xmlrpc.php HTTP/1.1"
Port Scan
Web App Attack
🇺🇸
dot.mg
2026-09-27 01:40:03
UTC ·
(1 month ago)
Abuse on login/xmlrpc
Brute-Force
🇫🇮
inlink.ltd
2026-09-26 23:07:45
UTC ·
(1 month ago)
Known malicious PHP file or CMS probe
Web App Attack