95.70.130.212

[Fri Nov 13 16:48:52.330888 2026] [security2:error] [pid 580346:tid 139646407263936] [client 95.70.130.212:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "bing" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset ... show more [Fri Nov 13 16:48:52.330888 2026] [security2:error] [pid 580346:tid 139646407263936] [client 95.70.130.212:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "bing" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "280"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: bing found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Linux; Android 9; SM-G892U Build/PPR1.180610.011; ) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Mobile Safari/537.36 BingSapphire/32.3.430811002 request_line = GET /index.php/profil/arsip-artikel?catid=620&id=555555659:prakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-26-april-02-mei-2017&start=10 HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/arsip-artikel"] [unique_id "avbdBKR8SBbI0k-fCp92BAAAAAc"], referer https://www.yahoo.go.id/ [staklim-jatim.bmkg.go.id] [sta ... show less

URL-probe: HTTP/1.1 POST request on /xmlrpc.php (2026-03-06 17:14:02 UTC+1)

(mod_security) mod_security (id:225170) triggered by 95.70.130.212 (212.130.70.95.dsl.dynamic.turk.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 05 15:46:50.145852 2026] [security2:error] [pid 14659:tid 1465 ... show more (mod_security) mod_security (id:225170) triggered by 95.70.130.212 (212.130.70.95.dsl.dynamic.turk.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 05 15:46:50.145852 2026] [security2:error] [pid 14659:tid 14659] [client 95.70.130.212:59891] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||aquanauticsige.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aquanauticsige.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aanrukaf8hGRL-owIq7F4AAAAAI"] show less

(mod_security) mod_security (id:225170) triggered by 95.70.130.212 (212.130.70.95.dsl.dynamic.turk.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 05 04:22:53.723721 2026] [security2:error] [pid 7153:tid 7153] ... show more (mod_security) mod_security (id:225170) triggered by 95.70.130.212 (212.130.70.95.dsl.dynamic.turk.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 05 04:22:53.723721 2026] [security2:error] [pid 7153:tid 7153] [client 95.70.130.212:59935] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||stalbansparish.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "stalbansparish.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aalLbbQZbbT-hkIBS1U54AAAAAU"] show less

Web attack/malicious scanning detected

95.70.130.212 - - [03/Mar/2026:09:46:40 -0600] "POST /xmlrpc.php HTTP/1.1" 301 242 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/60.0.0.0 Safari/537.36" ...

(mod_security) mod_security (id:225170) triggered by 95.70.130.212 (212.130.70.95.dsl.dynamic.turk.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 03 09:25:32.195491 2026] [security2:error] [pid 23039:tid 2303 ... show more (mod_security) mod_security (id:225170) triggered by 95.70.130.212 (212.130.70.95.dsl.dynamic.turk.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 03 09:25:32.195491 2026] [security2:error] [pid 23039:tid 23039] [client 95.70.130.212:60248] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||margroberts.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "margroberts.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aabvXCHg-SSIKNLduHPBeAAAAAM"] show less

(mod_security) mod_security (id:225170) triggered by 95.70.130.212 (212.130.70.95.dsl.dynamic.turk.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 03 09:00:36.098940 2026] [security2:error] [pid 29438:tid 2949 ... show more (mod_security) mod_security (id:225170) triggered by 95.70.130.212 (212.130.70.95.dsl.dynamic.turk.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 03 09:00:36.098940 2026] [security2:error] [pid 29438:tid 29494] [client 95.70.130.212:60260] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||luxury.management|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "luxury.management"] [uri "/wp-json/wp/v2/users"] [unique_id "aabphGFIXg6bVC1GKB89mQAAANE"] show less

95.70.130.212 - - [03/Mar/2026:09:01:18 +0200] "POST /xmlrpc.php HTTP/1.0" 200 593 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/73.0.0.0 Safari/537.36" 95.70.130.212 - - [03/Mar/2026:09:01:21 +0200] "POST /xml ... show more 95.70.130.212 - - [03/Mar/2026:09:01:18 +0200] "POST /xmlrpc.php HTTP/1.0" 200 593 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/73.0.0.0 Safari/537.36" 95.70.130.212 - - [03/Mar/2026:09:01:21 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/73.0.0.0 Safari/537.36" 95.70.130.212 - - [03/Mar/2026:09:02:16 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/99.0.0.0 Safari/537.36" 95.70.130.212 - - [03/Mar/2026:09:02:13 +0200] "POST /xmlrpc.php HTTP/1.0" 200 593 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/99.0.0.0 Safari/537.36" 95.70.130.212 - - [03/Mar/2026:09:03:23 +0200] "POST /xmlrpc.php HTTP/1.0" 200 593 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/100.0.0.0 Safari/537.36" ... show less

(wordpress) Failed wordpress login from 95.70.130.212 (TR/Türkiye/212.130.70.95.dsl.dynamic.turk.net)

(wordpress) Failed wordpress login from 95.70.130.212 (TR/Türkiye/Istanbul/Istanbul/212.130.70.95.dsl.dynamic.turk.net)

WordPress XMLRPC Brute Force Attack

Probing websites for vulnerabilities

Banned for trying to access xmlrpc

(mod_security) mod_security (id:225170) triggered by 95.70.130.212 (212.130.70.95.dsl.dynamic.turk.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 01 12:36:36.617166 2026] [security2:error] [pid 13916:tid 1391 ... show more (mod_security) mod_security (id:225170) triggered by 95.70.130.212 (212.130.70.95.dsl.dynamic.turk.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 01 12:36:36.617166 2026] [security2:error] [pid 13916:tid 13916] [client 95.70.130.212:59873] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||scswat.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "scswat.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aaR5JBXV_sGeff4fSdGk3QAAABo"] show less