2026-08-23 01:37.Categories: Brute-Force, Bad Web Bot.
Comment: 4.936 requests with url.path */xmlrpc.php
2026-08-22 23:12.Categories: Brute-Force, Bad Web Bot, Web App Attack.
Comment: (mod_security) mod_security (id:240335) triggered by 78.17.147.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 19:12:08.786794 2026] [security2:error] [pid 29766:tid 29766] [client 78.17.147.120:57777] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file “/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf”] [line “5956”] [id “240335”] [rev “5”] [msg “COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 78.17.147.120 (+1 hits since last alert)|geckoturner.com|F|2”] [severity “CRITICAL”] [tag “CWAF”] [tag “OtherApps”] [hostname “geckoturner.com”] [uri “/xmlrpc.php”] [unique_id “aoosyDLGv6Tk0cTt6a_4AgAAABM”]
2026-08-22 15:03.Categories: Web App Attack.
Comment: cloudlinux2 fail2ban: 2026-08-22 16:59:36,186 fail2ban.filter [1480]: INFO [plesk-wordpress] Found 185.198.240.46 – 2026-08-22 16:59:34cloudlinux2 fail2ban: 2026-08-22 17:00:04,450 fail2ban.filter [1480]: INFO [plesk-modsecurity] Found 188.64.173.63 – 2026-08-22 17:00:04cloudlinux2 fail2ban: 2026-08-22 17:00:54,140 fail2ban.filter [1480]: INFO [plesk-modsecurity] Found 78.17.147.120 – 2026-08-22 17:00:54cloudlinux2 fail2ban: 2026-08-22 17:01:39,287 fail2ban.filter [1480]: INFO [plesk-modsecurity] Found 188.64.173.63 – 2026-08-22 17:01:39cloudlinux2 fail2ban: 2026-08-22 17:02:00,524 fail2ban.filter [1480]: INFO [plesk-modsecurity] Found 188.64.173.63 – 2026-08-22 17:02:00cloudlinux2 fail2ban: 2026-08-22 17:02:00,982 fail2ban.actions [1480]: NOTICE [plesk-modsecurity] Ban 188.64.173.63cloudlinux2 fail2ban: 2026-08-22 17:02:00,989 fail2ban.filter [1480]: INFO [recidive] Found 188.64.173.63 – 2026-08-22 17:02:00cloudlinux2 fail2ban: 2026-08
2026-08-22 04:53.Categories: Brute-Force.
Comment: (wordpress) Failed wordpress login from 78.17.147.120 (DE/Germany/464946.vm.spacecore.network): (CF_ENABLE)
2026-08-22 04:20.Categories: Brute-Force, Bad Web Bot, Web App Attack.
Comment: (mod_security) mod_security (id:240335) triggered by 78.17.147.120 (464946.vm.spacecore.network): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 00:20:21.238616 2026] [security2:error] [pid 5194:tid 5194] [client 78.17.147.120:49272] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file “/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf”] [line “5956”] [id “240335”] [rev “5”] [msg “COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 78.17.147.120 (+1 hits since last alert)|zezel.com|F|2”] [severity “CRITICAL”] [tag “CWAF”] [tag “OtherApps”] [hostname “zezel.com”] [uri “/xmlrpc.php”] [unique_id “aokjhRIEt15T9VP5PW9xbQAAAAM”]
2026-08-22 04:18.Categories: Brute-Force, Web App Attack.
Comment: WordPress XMLRPC Brute Force Attacks …
2026-08-22 01:33.Categories: Brute-Force, Web App Attack.
Comment: WordPress XMLRPC Brute Force Attack
2026-08-21 22:38.Categories: Hacking, Web App Attack.
Comment: [redacted] 78.17.147.120 – – [22/Aug/2026:00:37:48 +0200] “POST /xmlrpc.php HTTP/1.1” 405 428 “-” “WordPress.com; https://wordpress.com” [redacted] 78.17.147.120 – – [22/Aug/2026:00:37:58 +0200] “POST /xmlrpc.php HTTP/1.1” 405 428 “-” “Jetpack/12.1; WordPress/6.4; http://site97856291.com” [redacted] 78.17.147.120 – – [22/Aug/2026:00:38:09 +0200] “POST /xmlrpc.php HTTP/1.1” 405 428 “-” “Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.4)” [redacted] 78.17.147.120 – – [22/Aug/2026:00:38:20 +0200] “POST /xmlrpc.php HTTP/1.1” 405 428 “-” “Jetpack by WordPress.com” [redacted] 78.17.147.120 – – [22/Aug/2026:00:38:31 +0200] “POST /xmlrpc.php HTTP/1.1” 405 428 “-” “WordPress.com; https://wordpress.com” …
2026-08-21 10:54.Categories: Web App Attack.
Comment: 78.17.147.120 – – [21/Aug/2026:12:52:50 +0200] “POST /xmlrpc.php HTTP/1.1” 200 5348 “-” “WordPress.com; https://wordpress.com” 78.17.147.120 – – [21/Aug/2026:12:52:59 +0200] “POST /xmlrpc.php HTTP/1.1” 200 5348 “-” “Jetpack/12.0; WordPress/6.1; http://site44821710.com” 78.17.147.120 – – [21/Aug/2026:12:53:10 +0200] “POST /xmlrpc.php HTTP/1.1” 200 5348 “-” “Jetpack/13.0; WordPress/6.2; http://site66236325.com” 78.17.147.120 – – [21/Aug/2026:12:53:20 +0200] “POST /xmlrpc.php HTTP/1.1” 200 5348 “-” “WordPress.com; https://wordpress.com” 78.17.147.120 – – [21/Aug/2026:12:53:32 +0200] “POST /xmlrpc.php HTTP/1.1” 200 5348 “-” “Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.3)” 78.17.147.120 – – [21/Aug/2026:12:53:44 +0200] “POST /xmlrpc.php HTTP/1.1” 200 5348 “-” “Jetpack by WordPress.com” 78.17.147.120 – – [21/Aug/2026:12:53:53 +0200] “POST /xmlrpc.php HTTP/1.1” 200 5348 “-” “WordPress.com; https://wordpress.com” 78.17.147.120 – – [21/Aug/2026:12:54:03 +0200] “POST /xmlrpc.php HTTP/1.1 …
2026-08-21 03:10.Categories: Brute-Force, Bad Web Bot, Web App Attack.
Comment: (mod_security) mod_security (id:240335) triggered by 78.17.147.120 (464946.vm.spacecore.network): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 23:10:01.664235 2026] [security2:error] [pid 7531:tid 7603] [client 78.17.147.120:55529] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file “/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf”] [line “5956”] [id “240335”] [rev “5”] [msg “COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 78.17.147.120 (+1 hits since last alert)|wedgwoodclub.com|F|2”] [severity “CRITICAL”] [tag “CWAF”] [tag “OtherApps”] [hostname “wedgwoodclub.com”] [uri “/xmlrpc.php”] [unique_id “aofBiYhfXbhKhcHPQipNKAAAA0s”]
2026-08-21 01:26.Categories: Brute-Force, Bad Web Bot, Web App Attack.
Comment: (mod_security) mod_security (id:240335) triggered by 78.17.147.120 (464946.vm.spacecore.network): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 21:26:00.927402 2026] [security2:error] [pid 3357:tid 3357] [client 78.17.147.120:62328] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file “/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf”] [line “5965”] [id “240335”] [rev “5”] [msg “COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 78.17.147.120 (+1 hits since last alert)|aifactoid.com|F|2”] [severity “CRITICAL”] [tag “CWAF”] [tag “OtherApps”] [hostname “aifactoid.com”] [uri “/xmlrpc.php”] [unique_id “aoepKLpRqSYAG9WTTw83vwAAAAc”]
2026-08-21 00:01.Categories: Bad Web Bot, Web App Attack.
Comment: Automated scanner targeting WordPress installations. Source produced sustained scanning activity exceeding 100 requests within a 60-minute window.
2026-08-20 22:52.Categories: Brute-Force, Bad Web Bot, Web App Attack.
Comment: (mod_security) mod_security (id:240335) triggered by 78.17.147.120 (464946.vm.spacecore.network): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 18:52:23.030125 2026] [security2:error] [pid 21545:tid 21545] [client 78.17.147.120:60484] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file “/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf”] [line “5956”] [id “240335”] [rev “5”] [msg “COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 78.17.147.120 (+1 hits since last alert)|thenutritionfixhollysprings.com|F|2”] [severity “CRITICAL”] [tag “CWAF”] [tag “OtherApps”] [hostname “thenutritionfixhollysprings.com”] [uri “/xmlrpc.php”] [unique_id “aoeFJ6fKkZppfYwRl5N7vwAAAAU”]
2026-08-20 17:10.Categories: Brute-Force, Bad Web Bot, Web App Attack.
Comment: (mod_security) mod_security (id:240335) triggered by 78.17.147.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 13:10:33.056373 2026] [security2:error] [pid 22529:tid 22529] [client 78.17.147.120:53897] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file “/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf”] [line “5965”] [id “240335”] [rev “5”] [msg “COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 78.17.147.120 (+1 hits since last alert)|renomarsh.com|F|2”] [severity “CRITICAL”] [tag “CWAF”] [tag “OtherApps”] [hostname “renomarsh.com”] [uri “/xmlrpc.php”] [unique_id “aoc1CQowf6z0dQpTWRt-nAAAAAg”]
2026-08-20 16:32.Categories: Brute-Force, Web App Attack.
Comment: WordPress XMLRPC Brute Force Attack
2026-08-20 15:52.Categories: Port Scan, Brute-Force, Web App Attack.
Comment: [ThuAug2017:52:36.2511322026][security2:error][pid4053879:tid4054009][client78.17.147.120:0]ModSecurity:Accessdeniedwithcode403(phase1).Stringmatch\”/xmlrpc.php\”atREQUEST_URI.[file\”/etc/apache2/conf.d/modsec_custom_rules.conf\”][line\”170\”][id\”960024\”][msg\”XML-RPCdisabled\”][hostname\”giftech.ch\”][uri\”/xmlrpc.php\”][unique_id\”aocixHuBEjiYGZ04jLEtVgAAAVM\”]
2026-08-20 08:28.Categories: Brute-Force.
Comment: (wordpress) Failed wordpress login from 78.17.147.120 (DE/Germany/-)
2026-08-20 04:00.Categories: DDoS Attack Participating, Brute-Force.
Comment: xmlrpc.php Potential DDoS or brute force
2026-08-20 02:44.Categories: Brute-Force, Bad Web Bot, Web App Attack.
Comment: (mod_security) mod_security (id:240335) triggered by 78.17.147.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 19 22:44:07.698675 2026] [security2:error] [pid 21122:tid 21122] [client 78.17.147.120:55773] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file “/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf”] [line “5956”] [id “240335”] [rev “5”] [msg “COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 78.17.147.120 (+1 hits since last alert)|georgegourmet.com|F|2”] [severity “CRITICAL”] [tag “CWAF”] [tag “OtherApps”] [hostname “georgegourmet.com”] [uri “/xmlrpc.php”] [unique_id “aoZp99gyGpLYW7PTWOMm6AAAAAE”]
2026-08-20 00:17.Categories: Brute-Force, Bad Web Bot, Web App Attack.
Comment: (mod_security) mod_security (id:240335) triggered by 78.17.147.120 (464946.vm.spacecore.network): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 19 20:17:53.448789 2026] [security2:error] [pid 21002:tid 21002] [client 78.17.147.120:55052] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file “/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf”] [line “5956”] [id “240335”] [rev “5”] [msg “COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 78.17.147.120 (+1 hits since last alert)|forerunnersjazz.org|F|2”] [severity “CRITICAL”] [tag “CWAF”] [tag “OtherApps”] [hostname “forerunnersjazz.org”] [uri “/xmlrpc.php”] [unique_id “aoZHsfAZNfc-_KUjBqQLXAAAAAM”]
2026-08-19 23:32.Categories: Web App Attack.
Comment: 78.17.147.120 – – [19/Aug/2026:19:30:09 -0400] “POST /xmlrpc.php HTTP/1.1” 200 5279 “-” “WordPress.com; https://wordpress.com” 78.17.147.120 – – [19/Aug/2026:19:31:26 -0400] “POST /xmlrpc.php HTTP/1.1” 200 5279 “-” “WordPress.com; https://wordpress.com” 78.17.147.120 – – [19/Aug/2026:19:31:36 -0400] “POST /xmlrpc.php HTTP/1.1” 200 5279 “-” “WordPress.com; https://wordpress.com” 78.17.147.120 – – [19/Aug/2026:19:32:19 -0400] “POST /xmlrpc.php HTTP/1.1” 200 5279 “-” “WordPress.com; https://wordpress.com” 78.17.147.120 – – [19/Aug/2026:19:32:28 -0400] “POST /xmlrpc.php HTTP/1.1” 200 5279 “-” “WordPress.com; https://wordpress.com” …
2026-08-19 21:43.Categories: Brute-Force.
Comment: (wordpress) Failed wordpress login from 78.17.147.120 (DE/Germany/Hesse/Frankfurt am Main/464946.vm.spacecore.network)
2026-08-19 19:57.Categories: Web App Attack.
Comment: Excessive failed CAPTCHA attempts (CAPTCHA DoS)
