๐ฉ๐ช
LRob
2026-10-28 08:09:46
(6 days ago)
WordPress attack-tool calls | method: POST | path: /xmlrpc.php | ua: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/71.0.0.0 Safari/537.36 | 2026-10-28 08:09 UTC
Web App Attack
Hacking
๐บ๐ธ
IndigoRidge
2026-10-25 08:36:07
(1 week ago)
86.105.145.43 - - [25/Oct/2026:04:33:29 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5128 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/99.0.0.0 Safari/537.36"
86.105.145.43 - - [25/Oct/2026:04:35:04 -0400] " ...
show more
86.105.145.43 - - [25/Oct/2026:04:33:29 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5128 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/99.0.0.0 Safari/537.36"
86.105.145.43 - - [25/Oct/2026:04:35:04 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 200 13110 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
86.105.145.43 - - [25/Oct/2026:04:35:26 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5128 "-" "Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36"
86.105.145.43 - - [25/Oct/2026:04:35:47 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5128 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/81.0.0.0 Safari/537.36"
86.105.145.43 - - [25/Oct/2026:04:36:06 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5128 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/62.0.0.0 Safari/537.36"
...
show less
Web App Attack
๐ฉ๐ช
stinpriza
2026-10-25 07:39:42
(1 week ago)
Web App Attack
Web App Attack
Anonymous
2026-10-25 06:33:13
(1 week ago)
WordPress login / xmlrpc probing across multiple sites
Web App Attack
๐ณ๐ด
jad-abuse
2026-10-24 10:27:52
(1 week ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 2 sensor(s); 2 hits.
Brute-Force
Web App Attack
Anonymous
2026-10-20 10:44:19
(2 weeks ago)
WordPress login / xmlrpc probing across multiple sites
Web App Attack
๐บ๐ธ
IndigoRidge
2026-10-20 09:44:56
(2 weeks ago)
86.105.145.43 - - [20/Oct/2026:05:41:23 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5279 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/83.0.0.0 Safari/537.36"
86.105.145.43 - - [20/Oct/2026:05:43:43 -0400] "GET ...
show more
86.105.145.43 - - [20/Oct/2026:05:41:23 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5279 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/83.0.0.0 Safari/537.36"
86.105.145.43 - - [20/Oct/2026:05:43:43 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 403 5478 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
86.105.145.43 - - [20/Oct/2026:05:44:16 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5263 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/82.0.0.0 Safari/537.36"
86.105.145.43 - - [20/Oct/2026:05:44:36 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5279 "-" "Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/72.0.0.0 Safari/537.36"
86.105.145.43 - - [20/Oct/2026:05:44:55 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5295 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/12.0.0.0 Safari/537.36"
...
show less
Web App Attack
๐ฉ๐ช
v1nc
2026-10-17 14:04:12
(2 weeks ago)
86.105.145.43 - - [17/Oct/2026:14:04:12 +0000] "POST /xmlrpc.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/95.0.0.0 Safari/537.36"
...
Hacking
Anonymous
2026-10-14 06:45:46
(2 weeks ago)
[server.tmg.gr] httpd-xmlrpc-post: sites=www.exarjournal.com; logs=/var/log/httpd/domains/exarjournal.com.log; samples=/xmlrpc.php
Brute-Force
Web App Attack
๐ง๐ช
madeit
2026-10-11 23:56:15
(3 weeks ago)
Web App Attack
๐ณ๐ฑ
enpepet
2026-10-11 00:39:35
(3 weeks ago)
GENERAL: parametres: [url:xmlrpc=] UA:Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 URL:/xmlrpc.php
Port Scan
Hacking
Brute-Force
Bad Web Bot
๐ฉ๐ช
4server
2026-10-10 18:59:27
(3 weeks ago)
[SatOct1020:59:25.3776382026][security2:error][pid1431873:tid1431886][client86.105.145.43:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\" ...
show more
[SatOct1020:59:25.3776382026][security2:error][pid1431873:tid1431886][client86.105.145.43:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"galardi.ch\"][uri\"/xmlrpc.php\"][unique_id\"asqLDYJUxiuX91k9TXAmdgAAAAo\"]
show less
Port Scan
Brute-Force
Web App Attack
๐ธ๐ฌ
khairilgunawan
2026-10-05 06:21:45
(4 weeks ago)
ZonaKuota Sentinel: Malicious automated scanner/exploit probe trapped. Blocked.
Web App Attack
Bad Web Bot
๐ฉ๐ช
4server
2026-10-04 14:47:33
(4 weeks ago)
[SunOct0416:47:27.9390032026][security2:error][pid1014222:tid1014455][client86.105.145.43:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\" ...
show more
[SunOct0416:47:27.9390032026][security2:error][pid1014222:tid1014455][client86.105.145.43:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"giuliani.li\"][uri\"/xmlrpc.php\"][unique_id\"asJm_4vjIfYz6RfC20HO5gAAAks\"]
show less
Port Scan
Brute-Force
Web App Attack
๐บ๐ธ
mnsf
2026-09-30 11:05:35
(1 month ago)
Xmlrpc Caught (8)
Brute-Force
Web App Attack