Anonymous
2026-09-16 13:45:27
UTC ·
(1 month ago)
Observed scanned 6 known-sensitive endpoint(s), e.g.: //2019/wp-includes/wlwmanifest.xml, //2020/wp-includes/wlwmanifest.xml, //test/wp-includes/wlwmanifest.xml, //web/wp-includes/wlwmanifest.xml, //wordpress/wp-includes/wlwmanifest.xml, //wp1/wp-inc ...
show more
Observed scanned 6 known-sensitive endpoint(s), e.g.: //2019/wp-includes/wlwmanifest.xml, //2020/wp-includes/wlwmanifest.xml, //test/wp-includes/wlwmanifest.xml, //web/wp-includes/wlwmanifest.xml, //wordpress/wp-includes/wlwmanifest.xml, //wp1/wp-includes/wlwmanifest.xml
show less
Bad Web Bot
Web App Attack
Anonymous
2026-09-16 09:46:01
UTC ·
(1 month ago)
[redacted] 136.70.177.189 - - [16/Sep/2026:11:45:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 136.70.177.189 - - [16 ...
show more
[redacted] 136.70.177.189 - - [16/Sep/2026:11:45:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 136.70.177.189 - - [16/Sep/2026:11:45:55 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 136.70.177.189 - - [16/Sep/2026:11:45:55 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 136.70.177.189 - - [16/Sep/2026:11:45:56 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 136.70.177.189 - - [16/Sep/2026:11:45:57 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Wind
...
show less
Hacking
Web App Attack
Anonymous
2026-09-16 09:45:31
UTC ·
(1 month ago)
fail2ban:piguard2:18,19,21
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
JLKnoch Software GmbH
2026-09-16 09:43:25
UTC ·
(1 month ago)
CrowdSec crowdsecurity/http-probing
Brute-Force
Web App Attack
🇩🇪
rh24
2026-09-16 09:40:42
UTC ·
(1 month ago)
(wlwmanifest) wlwmanifest.xml scanner (WordPress probe) from 136.70.177.189 (US/United States/189.177.70.136.bc.googleusercontent.com)
Hacking
🇩🇪
Viveronese
2026-09-16 09:36:48
UTC ·
(1 month ago)
HTTP vulnerability scanning
Web App Attack
🇩🇪
netclix.gr
2026-09-16 09:30:55
UTC ·
(1 month ago)
(wordpress) Failed wordpress login from 136.70.177.189 (US/United States/189.177.70.136.bc.googleusercontent.com): (CF_ENABLE)
Brute-Force
🇳🇱
WeCloudit-Anti-Abuse
2026-09-16 09:30:49
UTC ·
(1 month ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
Anonymous
2026-09-16 09:23:39
UTC ·
(1 month ago)
136.70.177.189 - - [16/Sep/2026:06:23:37 -0300] "GET /wp-includes/ID3/license.txt HTTP/1.1" 404 207 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
136.70.177.189 - - [16/Sep/20 ...
show more
136.70.177.189 - - [16/Sep/2026:06:23:37 -0300] "GET /wp-includes/ID3/license.txt HTTP/1.1" 404 207 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
136.70.177.189 - - [16/Sep/2026:06:23:37 -0300] "GET /xmlrpc.php?rsd HTTP/1.1" 404 1807 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
136.70.177.189 - - [16/Sep/2026:06:23:37 -0300] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 207 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
...
show less
Port Scan
Anonymous
2026-09-16 09:23:07
UTC ·
(1 month ago)
(wordpress) Failed wordpress login from 136.70.177.189 (US/United States/189.177.70.136.bc.googleusercontent.com)
Brute-Force
🇳🇱
Savvii
2026-09-16 09:21:21
UTC ·
(1 month ago)
15 attempts against mh-modsecurity-ban on pf221102
Brute-Force
Web App Attack
🇳🇿
Tripwire
2026-09-16 09:18:49
UTC ·
(1 month ago)
Scanning for exploits - //wp-includes/ID3/license.txt
Web App Attack
Anonymous
2026-09-16 09:12:20
UTC ·
(1 month ago)
136.70.177.189 - - [16/Sep/2026:11:12:18 +0200] "GET /wp-includes/ID3/license.txt HTTP/1.1" 404 567 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
136.70.177.189 - - [16/Sep/20 ...
show more
136.70.177.189 - - [16/Sep/2026:11:12:18 +0200] "GET /wp-includes/ID3/license.txt HTTP/1.1" 404 567 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
136.70.177.189 - - [16/Sep/2026:11:12:19 +0200] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 567 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
136.70.177.189 - - [16/Sep/2026:11:12:19 +0200] "GET /web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 567 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
136.70.177.189 - - [16/Sep/2026:11:12:19 +0200] "GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 567 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
136.70.177.189 - - [16/Sep/2026:11:12:20 +0200] "GET /wp/wp-includes/wlwmanifest.xml HTTP/1.1" 40
...
show less
Brute-Force
Web App Attack
🇩🇪
LRob
2026-09-16 09:10:53
UTC ·
(1 month ago)
Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for | method: GET | path: / | 2026-09-16 09:10 UTC
Bad Web Bot
🇨🇭
zynex
2026-09-16 09:10:28
UTC ·
(1 month ago)
URL Probing: /wp1/wp-includes/wlwmanifest.xml
Web App Attack