🇫🇷
Yepngo
2026-07-14 20:49:08
(2 days ago)
103.149.146.241 - - [14/Jul/2026:22:49:00 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Jetpack by ...
show more
103.149.146.241 - - [14/Jul/2026:22:49:00 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.3)"
103.149.146.241 - - [14/Jul/2026:22:49:07 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Jetpack/12.1; WordPress/6.2; http://site10681460.com"
...
show less
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-07-14 19:49:46
(2 days ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
2026-07-14 19:19:06
(2 days ago)
[redacted] 103.149.146.241 - - [14/Jul/2026:21:18:18 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" ...
show more
[redacted] 103.149.146.241 - - [14/Jul/2026:21:18:18 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/13.0; WordPress/6.1; http://site10513515.com"
[redacted] 103.149.146.241 - - [14/Jul/2026:21:18:28 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.0; WordPress/6.1; http://site93459905.com"
[redacted] 103.149.146.241 - - [14/Jul/2026:21:18:40 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.0; WordPress/6.3; http://site83945788.com"
[redacted] 103.149.146.241 - - [14/Jul/2026:21:18:49 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
[redacted] 103.149.146.241 - - [14/Jul/2026:21:19:01 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-07-14 18:51:06
(2 days ago)
(mod_security) mod_security (id:240335) triggered by 103.149.146.241 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 103.149.146.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 14:50:57.409866 2026] [security2:error] [pid 18432:tid 18432] [client 103.149.146.241:50813] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.149.146.241 (+1 hits since last alert)|bonegym.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "bonegym.com"] [uri "/xmlrpc.php"] [unique_id "alaFEUV_DBJF74L3WSUtfgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-14 09:36:49
(2 days ago)
[redacted] 103.149.146.241 - - [14/Jul/2026:11:36:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" ...
show more
[redacted] 103.149.146.241 - - [14/Jul/2026:11:36:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com"
[redacted] 103.149.146.241 - - [14/Jul/2026:11:36:15 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.3)"
[redacted] 103.149.146.241 - - [14/Jul/2026:11:36:26 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.4)"
[redacted] 103.149.146.241 - - [14/Jul/2026:11:36:37 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.5; WordPress/6.4; http://site40802683.com"
[redacted] 103.149.146.241 - - [14/Jul/2026:11:36:47 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.4)"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-07-13 19:43:40
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 103.149.146.241 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 103.149.146.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 15:43:35.739648 2026] [security2:error] [pid 22362:tid 22384] [client 103.149.146.241:58694] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.149.146.241 (+1 hits since last alert)|supercyprus.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "supercyprus.com"] [uri "/xmlrpc.php"] [unique_id "alU_52oAJ6BnWMcQg9LuWwAAAQA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-07-12 18:52:40
(4 days ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
2026-07-12 01:31:07
(5 days ago)
[server.tmg.gr] httpd-xmlrpc-post: sites=www.geomed.gr; logs=/var/log/httpd/domains/geomed.gr.log; s ...
show more
[server.tmg.gr] httpd-xmlrpc-post: sites=www.geomed.gr; logs=/var/log/httpd/domains/geomed.gr.log; samples=/xmlrpc.php
show less
Brute-Force
Web App Attack
🇺🇸
kosada.com
2026-07-11 04:59:04
(6 days ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
cwytech
2026-07-08 17:42:57
(1 week ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-xmlrpc-bf-high.
Bad Web Bot
Web App Attack
🇫🇷
LRob
2026-07-08 17:10:49
(1 week ago)
CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc | req: ["/xmlrpc.php"] | UA: ["Jetpack by WordPr ...
show more
CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc | req: ["/xmlrpc.php"] | UA: ["Jetpack by WordPress.com","Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.2)","WordPress.com; https://wordpress.com","Jetpack by WordPress.com
show less
Brute-Force
Web App Attack
🇪🇸
alferez
2026-07-08 15:41:21
(1 week ago)
xmlrpc.php attack DOS
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-07-07 15:57:48
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 103.149.146.241 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 103.149.146.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 11:57:40.927620 2026] [security2:error] [pid 32224:tid 32224] [client 103.149.146.241:54271] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.149.146.241 (+1 hits since last alert)|goseethenurse.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "goseethenurse.com"] [uri "/xmlrpc.php"] [unique_id "ak0h9EYf8NMhGXn-0FkaNwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-06 13:40:06
(1 week ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-07-05 21:42:33
(1 week ago)
(mod_security) mod_security (id:240335) triggered by 103.149.146.241 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 103.149.146.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 17:42:27.745086 2026] [security2:error] [pid 19447:tid 19447] [client 103.149.146.241:55460] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.149.146.241 (+1 hits since last alert)|varnadorefamily.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "varnadorefamily.com"] [uri "/xmlrpc.php"] [unique_id "akrPwwhMKPlakOPSeNnIqgAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack