Anonymous
2026-09-30 12:21:41
UTC ·
(1 month ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-09-30 09:06:48
UTC ·
(1 month ago)
37.280 requests in 1 hour (3mos2d17h)
Brute-Force
Bad Web Bot
Anonymous
2026-09-30 09:05:42
UTC ·
(1 month ago)
[redacted] 136.90.107.26 - - [30/Sep/2026:11:05:29 +0200] "POST //xmlrpc.php HTTP/1.1" 200 461 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 136.90.107.26 - - [30/ ...
show more
[redacted] 136.90.107.26 - - [30/Sep/2026:11:05:29 +0200] "POST //xmlrpc.php HTTP/1.1" 200 461 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 136.90.107.26 - - [30/Sep/2026:11:05:31 +0200] "POST //xmlrpc.php HTTP/1.1" 200 461 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 136.90.107.26 - - [30/Sep/2026:11:05:32 +0200] "POST //xmlrpc.php HTTP/1.1" 200 461 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 136.90.107.26 - - [30/Sep/2026:11:05:33 +0200] "POST //xmlrpc.php HTTP/1.1" 200 461 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 136.90.107.26 - - [30/Sep/2026:11:05:34 +0200] "POS
...
show less
Hacking
Web App Attack
🇪🇸
robotstxt
2026-09-30 09:04:51
UTC ·
(1 month ago)
136.90.107.26 - - [30/Sep/2026:09:03:49 +0000] "GET //wp-includes/id3/license.txt/xmlrpc.php?rsd HTTP/1.1" 403 5 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "-" edge="136.90 ...
show more
136.90.107.26 - - [30/Sep/2026:09:03:49 +0000] "GET //wp-includes/id3/license.txt/xmlrpc.php?rsd HTTP/1.1" 403 5 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "-" edge="136.90.107.26"
136.90.107.26 - - [30/Sep/2026:09:03:49 +0000] "GET //wp-includes/id3/license.txt/blog/wp-includes/wlwmanifest.xml HTTP/1.1" 403 5 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "-" edge="136.90.107.26"
136.90.107.26 - - [30/Sep/2026:09:03:49 +0000] "GET //wp-includes/id3/license.txt/web/wp-includes/wlwmanifest.xml HTTP/1.1" 403 5 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "-" edge="136.90.107.26"
136.90.107.26 - - [30/Sep/2026:09:03:50 +0000] "GET //wp-includes/id3/license.txt/wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 403 5 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
...
show less
Web App Attack
🇨🇭
backslash
2026-09-30 09:03:00
UTC ·
(1 month ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇮🇱
Dolphi
2026-09-30 09:02:19
UTC ·
(1 month ago)
POST //xmlrpc.php
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-09-30 09:00:15
UTC ·
(1 month ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇨🇭
Origon
2026-09-30 08:59:21
UTC ·
(1 month ago)
http-probing - IP: 136.90.107.26 - time="2026-09-30T10:59:21+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-probing by ip 136.90.107.26 (US/396982) : 4h ban on Ip 136.90.107.26" module=db
Web App Attack
🇳🇱
e.fierstra
2026-09-30 08:57:56
UTC ·
(1 month ago)
excessive HTTP 404 errors
Bad Web Bot
🇺🇸
ne1for23
2026-09-30 08:46:55
UTC ·
(1 month ago)
Probing for installed vulnerable software.
136.90.107.26 - - [30/Sep/2026:08:46:54 +0000] "GET //wp-includes/ID3/license.txt HTTP/1.1" 403 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 ...
show more
Probing for installed vulnerable software.
136.90.107.26 - - [30/Sep/2026:08:46:54 +0000] "GET //wp-includes/ID3/license.txt HTTP/1.1" 403 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
show less
Hacking
🇧🇾
lns.bz
2026-09-30 08:43:50
UTC ·
(1 month ago)
Too many 404 requests [BY]
Web App Attack
🇺🇸
kosada.com
2026-09-30 08:42:57
UTC ·
(1 month ago)
Repeated requests for suspicious nonexistent URLs, for example: //wp/wp-includes/wlwmanifest.xml (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36")
Web App Attack
Anonymous
2026-09-30 08:32:32
UTC ·
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇪🇸
robotstxt
2026-09-30 08:28:23
UTC ·
(1 month ago)
136.90.107.26 - - [30/Sep/2026:08:27:22 +0000] "GET //xmlrpc.php?rsd HTTP/1.1" 403 5 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "-" edge="136.90.107.26"
136.90.107.26 - - [ ...
show more
136.90.107.26 - - [30/Sep/2026:08:27:22 +0000] "GET //xmlrpc.php?rsd HTTP/1.1" 403 5 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "-" edge="136.90.107.26"
136.90.107.26 - - [30/Sep/2026:08:27:23 +0000] "GET //wp-includes/id3/license.txt/feed/ HTTP/1.1" 403 5 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "-" edge="136.90.107.26"
136.90.107.26 - - [30/Sep/2026:08:27:24 +0000] "GET //wp-includes/id3/license.txt/xmlrpc.php?rsd HTTP/1.1" 403 5 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "-" edge="136.90.107.26"
136.90.107.26 - - [30/Sep/2026:08:27:24 +0000] "GET //wp-includes/id3/license.txt/blog/wp-includes/wlwmanifest.xml HTTP/1.1" 403 5 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "-" edge
...
show less
Web App Attack
Anonymous
2026-09-30 08:24:21
UTC ·
(1 month ago)
[ns67.kdns.gr] httpd-suspicious-path: sites=kapaweb.gr,www.kweb.gr; logs=/var/www/vhosts/kapaweb.gr/logs/access_ssl_log,/var/www/vhosts/system/kapaweb.gr/logs/proxy_access_log; samples=//wp-includes/ID3/license.txt | //blog/wp-includes/wlwmanifest.xm ...
show more
[ns67.kdns.gr] httpd-suspicious-path: sites=kapaweb.gr,www.kweb.gr; logs=/var/www/vhosts/kapaweb.gr/logs/access_ssl_log,/var/www/vhosts/system/kapaweb.gr/logs/proxy_access_log; samples=//wp-includes/ID3/license.txt | //blog/wp-includes/wlwmanifest.xml | //web/wp-includes/wlwmanifest.xml
show less
Hacking
Web App Attack