🇺🇦
URAN Publishing Service
2026-10-27 02:34:53
(27 minutes ago)
[27/Oct/2026:04:34:52 +0200] -- 85.204.70.90 Ban reason: Scanner [CMS_GENERIC] | Request: GET //wp-i ...
show more
[27/Oct/2026:04:34:52 +0200] -- 85.204.70.90 Ban reason: Scanner [CMS_GENERIC] | Request: GET //wp-includes/wlwmanifest.xml HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇩🇪
Viveronese
2026-10-27 02:33:10
(29 minutes ago)
HTTP vulnerability scanning
Web App Attack
🇵🇰
sbk97 (https://sayor.net)
2026-10-27 02:30:09
(32 minutes ago)
SAYOR honeypot: observed attack /wp-json/oembed/1.0/embed?url=http://sayor.net
Brute-Force
🇳🇱
e.fierstra
2026-10-27 02:18:20
(43 minutes ago)
excessive HTTP 404 errors
Bad Web Bot
🇺🇸
HJ5Ss4Ju
2026-10-27 02:17:18
(44 minutes ago)
Wordfence firewall block
Web App Attack
🇹🇷
neron
2026-10-26 20:34:59
(6 hours ago)
CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall
Hacking
Web App Attack
🇦🇺
Klaverstyn
2026-10-26 08:25:20
(18 hours ago)
Repeated 403 Forbidden responses
Web App Attack
🇧🇷
maviei
2026-10-26 08:17:48
(18 hours ago)
85.204.70.90 - - [26/Oct/2026:05:17:46 -0300] "GET //wp-includes/wlwmanifest.xml HTTP/2.0" 403 5459 ...
show more
85.204.70.90 - - [26/Oct/2026:05:17:46 -0300] "GET //wp-includes/wlwmanifest.xml HTTP/2.0" 403 5459 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 0.000 -
85.204.70.90 - - [26/Oct/2026:05:17:46 -0300] "GET //blog/wp-includes/wlwmanifest.xml HTTP/2.0" 403 5459 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 0.000 -
...
show less
Web App Attack
🇵🇱
Budyn
2026-10-26 07:25:30
(19 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: keycloak.sweetpuddingtrap.online | URI: /.well-knownold/ | UA: Unknown User-Agent | BODY: [Empty / GET Request] | HEADERS: {"Accept-Encoding":"gzip, br","Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"FR","Cf-Connecting-Ip":"85.204.70.90","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a507ba3afc7b782f-CDG","X-Forwarded-For":"85.204.70.90","X-Waf-Trigger":"1"}
show less
Hacking
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-10-26 07:00:33
(20 hours ago)
85.204.70.90 - - [26/Oct/2026:07:00:31 +0000] "GET /cgi-bin/ HTTP/2.0" 404 994 "-" "-"
Bad Web Bot
🇩🇪
macrob
2026-10-26 06:31:17
(20 hours ago)
2026/10/26 06:31:15 [error] 2039726#2039726: *11175814 access forbidden by rule, client: 85.204.70.9 ...
show more
2026/10/26 06:31:15 [error] 2039726#2039726: *11175814 access forbidden by rule, client: 85.204.70.90, server: binixo-vn.com, request: "GET //wp-includes/wlwmanifest.xml HTTP/2.0", host: "binixo-vn.com"
2026/10/26 06:31:15 [error] 2039726#2039726: *11242617 access forbidden by rule, client: 85.204.70.90, server: binixo-vn.com, request: "GET //xmlrpc.php?rsd HTTP/2.0", host: "binixo-vn.com"
2026/10/26 06:31:15 [error] 2039726#2039726: *11242617 access forbidden by rule, client: 85.204.70.90, server: binixo-vn.com, request: "GET //blog/wp-includes/wlwmanifest.xml HTTP/2.0", host: "binixo-vn.com"
...
show less
Web App Attack
🇨🇦
webemsegundos
2026-10-26 06:08:17
(20 hours ago)
Web vulnerability scanner: 18 probe paths (e.g. /wp-includes/wlwmanifest.xml, /xmlrpc.php, /blog/wp- ...
show more
Web vulnerability scanner: 18 probe paths (e.g. /wp-includes/wlwmanifest.xml, /xmlrpc.php, /blog/wp-includes/wlwmanifest.xml, /web/wp-includes/wlwmanifest.xml, /wordpress/wp-includes/wlwmanifest.xml, /website/wp-includes/wlwmanifest.xml). Blocked by WeS Firewall.
show less
Bad Web Bot
Web App Attack
🇭🇺
kranem
2026-10-26 06:00:01
(21 hours ago)
Triggered Cloudflare WAF from FR.
Action taken: BLOCK
ASN: 25369 (Hydra Communications Ltd)
Protocol ...
show more
Triggered Cloudflare WAF from FR.
Action taken: BLOCK
ASN: 25369 (Hydra Communications Ltd)
Protocol: HTTP/1.1 (GET method)
Endpoint: /wp1/wp-includes/wlwmanifest.xml
Timestamp: 2026-10-26T05:56:17Z
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
show less
Bad Web Bot
🇫🇷
security.rdmc.fr
2026-10-26 05:48:27
(21 hours ago)
Activity from blacklisted IP
Hacking
🇵🇱
Budyn
2026-10-26 05:10:16
(21 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: vpn.teddypot.website | URI: /.well-known/ | UA: Unknown User-Agent | BODY: [Empty / GET Request] | HEADERS: {"Accept-Encoding":"gzip, br","Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"FR","Cf-Connecting-Ip":"85.204.70.90","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a506f41d4d0e803e-CDG","X-Forwarded-For":"85.204.70.90","X-Waf-Trigger":"1"}
show less
Hacking
Web App Attack