🇳🇱
Site.eu
2026-06-23 07:45:32
(2 weeks ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇫🇷
sasbau
2026-06-23 06:31:37
(2 weeks ago)
103.146.169.57 - - [23/Jun/2026:08:31:13 +0200] "POST /xmlrpc.php HTTP/1.1" 403 146 "-" "Jetpack by ...
show more
103.146.169.57 - - [23/Jun/2026:08:31:13 +0200] "POST /xmlrpc.php HTTP/1.1" 403 146 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.4)"
103.146.169.57 - - [23/Jun/2026:08:31:22 +0200] "POST /xmlrpc.php HTTP/1.1" 403 146 "-" "Jetpack by WordPress.com"
103.146.169.57 - - [23/Jun/2026:08:31:33 +0200] "POST /xmlrpc.php HTTP/1.1" 403 146 "-" "Jetpack/12.1; WordPress/6.4; http://site94774466.com"
show less
Brute-Force
Web App Attack
🇪🇸
masterguru
2026-06-23 04:02:02
(2 weeks ago)
(xmlrpc) Failed xmlrpc access from 103.146.169.57 (ID/Indonesia/-): 5 in the last 3600 secs (0-122)
Hacking
🇩🇪
LRob
2026-06-23 04:00:15
(2 weeks ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 03:29:03
(2 weeks ago)
(mod_security) mod_security (id:240335) triggered by 103.146.169.57 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.146.169.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 23:28:59.668071 2026] [security2:error] [pid 30578:tid 30578] [client 103.146.169.57:59635] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.146.169.57 (+1 hits since last alert)|ritterlien.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ritterlien.com"] [uri "/xmlrpc.php"] [unique_id "ajn9ewDA4q5Ri8zjJ1JfOgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-06-22 05:37:16
(2 weeks ago)
xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)
Hacking
2026-06-22 03:05:32
(2 weeks ago)
[osotir.org] httpd-xmlrpc-post: sites=megasvasilios.gr; logs=/var/log/httpd/domains/megasvasilios.gr ...
show more
[osotir.org] httpd-xmlrpc-post: sites=megasvasilios.gr; logs=/var/log/httpd/domains/megasvasilios.gr.log; samples=/xmlrpc.php
show less
Brute-Force
Web App Attack
2026-06-18 08:38:51
(2 weeks ago)
Fail2ban filtered
...
Web App Attack
2026-06-18 05:20:20
(2 weeks ago)
Attac
Brute-Force
🇺🇸
TPI-Abuse
2026-06-18 04:57:14
(2 weeks ago)
(mod_security) mod_security (id:240335) triggered by 103.146.169.57 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.146.169.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 00:57:07.054684 2026] [security2:error] [pid 10867:tid 10867] [client 103.146.169.57:52751] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.146.169.57 (+1 hits since last alert)|altoshp.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "altoshp.com"] [uri "/xmlrpc.php"] [unique_id "ajN6o06Vaw7H_l5mRw-51AAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-06-17 08:15:13
(3 weeks ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 08:15:08
(3 weeks ago)
(mod_security) mod_security (id:240335) triggered by 103.146.169.57 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.146.169.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 04:15:00.926388 2026] [security2:error] [pid 31636:tid 31636] [client 103.146.169.57:58547] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.146.169.57 (+1 hits since last alert)|globalsolutions.technology|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "globalsolutions.technology"] [uri "/xmlrpc.php"] [unique_id "ajJXhKGNAk8z3Nf7kHi-WAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 04:41:44
(3 weeks ago)
(mod_security) mod_security (id:240335) triggered by 103.146.169.57 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.146.169.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 00:41:39.892584 2026] [security2:error] [pid 1201:tid 1222] [client 103.146.169.57:62410] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.146.169.57 (+1 hits since last alert)|visionforandfromchildren.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "visionforandfromchildren.org"] [uri "/xmlrpc.php"] [unique_id "ajIlg2pNw3ADLTEM_PrYEgAAAFM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 08:03:10
(3 weeks ago)
(mod_security) mod_security (id:240335) triggered by 103.146.169.57 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 103.146.169.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 04:03:04.079774 2026] [security2:error] [pid 31690:tid 31690] [client 103.146.169.57:51249] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.146.169.57 (+1 hits since last alert)|agrollum.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "agrollum.com"] [uri "/xmlrpc.php"] [unique_id "ai-xuBjccL4mkQqgrwJZ0AAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-06-15 07:19:14
(3 weeks ago)
trying wp-login.php/xmlrpc.php 34 times in 1 minutes
Brute-Force
Web App Attack