🇺🇸
sailor
2026-07-14 17:06:00
(1 day ago)
Probing for potential WP exploit file: POST .../xmlrpc.php
Web App Attack
Hacking
🇳🇴
jad-abuse
2026-07-14 04:44:26
(2 days ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. O ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 1 hits.
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-13 23:45:33
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 84.215.101.235 (cm-84.215.101.235.get.no): 1 in ...
show more
(mod_security) mod_security (id:225170) triggered by 84.215.101.235 (cm-84.215.101.235.get.no): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 19:45:28.489914 2026] [security2:error] [pid 28565:tid 28640] [client 84.215.101.235:49654] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gabegabel.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gabegabel.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alV4mInnavxOiJHJmEi_ywAAAY8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
sailor
2026-07-13 20:21:00
(2 days ago)
Unauthorized attempt to access potential WP exploit file: POST .../xmlrpc.php
Web App Attack
Hacking
🇯🇵
Valhalla
2026-07-13 05:33:23
(3 days ago)
/xmlrpc.php
Hacking
Web App Attack
2026-07-13 05:20:09
(3 days ago)
Web attack blocked by Wordfence on helenehoenjet.nl (1 hit). Reported by CRMON.
Web App Attack
🇸🇪
EmK530
2026-07-13 01:21:38
(3 days ago)
URL flagged by RegEx: /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-07-12 19:25:10
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 84.215.101.235 (cm-84.215.101.235.get.no): 1 in ...
show more
(mod_security) mod_security (id:225170) triggered by 84.215.101.235 (cm-84.215.101.235.get.no): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 15:25:04.545403 2026] [security2:error] [pid 7998:tid 7998] [client 84.215.101.235:61903] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||alsetsystems.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "alsetsystems.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alPqENhVjgRlzp0JkaZS4AAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-11 17:09:44
(4 days ago)
Fail2Ban - Wordpress brute-force
...
Brute-Force
Web App Attack
2026-07-11 17:09:07
(4 days ago)
(wordpress) Failed wordpress login from 84.215.101.235 (NO/Norway/cm-84.215.101.235.get.no)
Brute-Force
2026-07-11 11:28:24
(4 days ago)
84.215.101.235 - - [11/Jul/2026:11:28:23 +0000] "POST /xmlrpc.php HTTP/1.1" 404 17313 "-" "Mozilla/5 ...
show more
84.215.101.235 - - [11/Jul/2026:11:28:23 +0000] "POST /xmlrpc.php HTTP/1.1" 404 17313 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-11 00:56:46
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 84.215.101.235 (cm-84.215.101.235.get.no): 1 in ...
show more
(mod_security) mod_security (id:225170) triggered by 84.215.101.235 (cm-84.215.101.235.get.no): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 20:56:42.014796 2026] [security2:error] [pid 6370:tid 6370] [client 84.215.101.235:58114] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||clipper1970.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "clipper1970.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alGUypLTmSbpSWVhVAAleQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
wlt-blocker
2026-07-09 12:48:10
(6 days ago)
Unauthorized access to webpage admin
Web App Attack
🇺🇸
TPI-Abuse
2026-07-09 07:48:14
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 84.215.101.235 (cm-84.215.101.235.get.no): 1 in ...
show more
(mod_security) mod_security (id:225170) triggered by 84.215.101.235 (cm-84.215.101.235.get.no): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 03:48:07.516708 2026] [security2:error] [pid 2418:tid 2418] [client 84.215.101.235:52040] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||transcapitalsolutions.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "transcapitalsolutions.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ak9SN_KSi82HtYHtHDZL1wAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
AbuseBaer
2026-07-06 12:41:13
(1 week ago)
access attempt detected by IDS script (B)
Web App Attack