🇳🇱
middelkoopcc
2026-07-31 06:15:05
(3 weeks ago)
2026-07-31 08:07:36 WordPress login error from 149.118.52.32: invalid_username && 2026-07-31 08:07:4 ...
show more
2026-07-31 08:07:36 WordPress login error from 149.118.52.32: invalid_username && 2026-07-31 08:07:47 WordPress login error from 149.118.52.32: invalid_email && 2026-07-31 08:07:57 WordPress login error from 149.118.52.32: invalid_username && 41 more within 20 minutes
show less
Brute-Force
🇧🇪
cmbplf
2026-07-30 14:09:57
(3 weeks ago)
6.710 4xx requests in 1 hour (1w6d21h)
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-29 15:03:30
(4 weeks ago)
(mod_security) mod_security (id:240335) triggered by 149.118.52.32 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 149.118.52.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 11:03:26.504790 2026] [security2:error] [pid 3409765:tid 3409765] [client 149.118.52.32:53051] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 149.118.52.32 (+1 hits since last alert)|advantagesystemsgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "advantagesystemsgroup.com"] [uri "/xmlrpc.php"] [unique_id "amoWPlfo3diH-SkrrlcEhQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-07-29 14:16:23
(4 weeks ago)
149.118.52.32 - - [29/Jul/2026:17:16:21 +0300] "POST /xmlrpc.php HTTP/1.1" 404 4728 "-" "Mozilla/5.0 ...
show more
149.118.52.32 - - [29/Jul/2026:17:16:21 +0300] "POST /xmlrpc.php HTTP/1.1" 404 4728 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
149.118.52.32 - - [29/Jul/2026:17:16:22 +0300] "GET /xmlrpc.php HTTP/1.1" 404 705 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇬🇷
setupgr
2026-07-29 12:29:04
(4 weeks ago)
(XMLRPC) WP XMLRPC Attack 149.118.52.32 (SG/Singapore/-/Singapore (Jurong East)/-/[AS31898 ORACLE-BM ...
show more
(XMLRPC) WP XMLRPC Attack 149.118.52.32 (SG/Singapore/-/Singapore (Jurong East)/-/[AS31898 ORACLE-BMC-31898]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 149.118.52.32 - - [29/Jul/2026:15:20:58 +0300] "POST /xmlrpc.php HTTP/1.1" 404 14983 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
show less
Port Scan
🇩🇪
4server
2026-07-29 11:17:55
(4 weeks ago)
[WedJul2913:17:49.4474562026][security2:error][pid1476012:tid1476102][client149.118.52.32:0]ModSecur ...
show more
[WedJul2913:17:49.4474562026][security2:error][pid1476012:tid1476102][client149.118.52.32:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"admin-services.ch\"][uri\"/xmlrpc.php\"][unique_id\"amnhXcmgdSDu6jI3PV7OYQAAAMA\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
kosada.com
2026-07-29 11:08:59
(4 weeks ago)
Web vulnerability probing: /xmlrpc.php
Web App Attack
🇺🇸
lostswordfish.com
2026-07-29 08:44:03
(4 weeks ago)
Wordfence waf block on lostswordfish
Web App Attack
🇺🇸
TPI-Abuse
2026-07-29 08:43:53
(4 weeks ago)
(mod_security) mod_security (id:240335) triggered by 149.118.52.32 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 149.118.52.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 04:43:48.290342 2026] [security2:error] [pid 28026:tid 28026] [client 149.118.52.32:57589] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 149.118.52.32 (+1 hits since last alert)|accommodation-perthairport.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "accommodation-perthairport.com"] [uri "/xmlrpc.php"] [unique_id "amm9RJtHNuw_GQNBNITMPQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-29 07:05:11
(4 weeks ago)
(mod_security) mod_security (id:240335) triggered by 149.118.52.32 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 149.118.52.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 03:05:03.252597 2026] [security2:error] [pid 1873253:tid 1873318] [client 149.118.52.32:52099] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 149.118.52.32 (+1 hits since last alert)|aclarityforensics.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "aclarityforensics.com"] [uri "/xmlrpc.php"] [unique_id "ammmH7lxqPhVDFIcoLMA2gAAAY4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
afleventoffice.com.au
2026-07-29 05:28:40
(4 weeks ago)
POST /xmlrpc.php HTTP/1.1
Web App Attack