🇲🇽
octageeks.com
2026-06-04 04:07:56
(1 week ago)
Wordpress malicious attack:[octawpauthor]
Web App Attack
🇫🇷
tecnicorioja
2026-06-03 22:00:11
(1 week ago)
POST /xmlrpc.php [03/Jun/2026:12:18:04
Brute-Force
Web App Attack
🇩🇪
Martin Lundstrom
2026-06-03 09:21:25
(1 week ago)
https://www.eagleeye-intelligence.com — WordPress attack. Automatically detected and blocked.
Web App Attack
2026-06-03 09:14:05
(1 week ago)
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/2.0
Hacking
Web App Attack
🇩🇪
AlexEventfahrtenIPDB
2026-06-03 09:13:16
(1 week ago)
[Wed Jun 03 11:13:15.163365 2026] [authz_core:error] [pid 803360:tid 803360] [client 138.252.125.121 ...
show more
[Wed Jun 03 11:13:15.163365 2026] [authz_core:error] [pid 803360:tid 803360] [client 138.252.125.121:46560] AH01630: client denied by server configuration: /var/www/std-sites/cadillac/wp-login.php
[Wed Jun 03 11:13:16.232946 2026] [authz_core:error] [pid 803381:tid 803381] [client 138.252.125.121:46576] AH01630: client denied by server configuration: /var/www/std-sites/cadillac/wp-login.php, referer: https://alex-eventfahrten.spdns.de/wp-login.php
...
show less
Brute-Force
Web App Attack
🇪🇸
masterguru
2026-06-03 09:10:53
(1 week ago)
(wplogin) Failed WordPress login from 138.252.125.121 (BD/Bangladesh/bdix121.wowbet.net): 5 in the l ...
show more
(wplogin) Failed WordPress login from 138.252.125.121 (BD/Bangladesh/bdix121.wowbet.net): 5 in the last 3600 secs (0-122)
show less
Hacking
🇩🇪
dbmwebdesign
2026-06-03 09:10:03
(1 week ago)
WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail
Brute-Force
Web App Attack
2026-06-03 09:03:09
(1 week ago)
138.252.125.121 - - [03/Jun/2026:10:55:02 +0200] "POST /xmlrpc.php HTTP/1.1" 200 439 "-" "Mozilla/5. ...
show more
138.252.125.121 - - [03/Jun/2026:10:55:02 +0200] "POST /xmlrpc.php HTTP/1.1" 200 439 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
138.252.125.121 - - [03/Jun/2026:10:55:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 225 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
138.252.125.121 - - [03/Jun/2026:10:55:29 +0200] "POST /xmlrpc.php HTTP/1.1" 200 439 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
138.252.125.121 - - [03/Jun/2026:10:55:29 +0200] "POST /xmlrpc.php HTTP/1.1" 200 225 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
138.252.125.121 - - [03/Jun/2026:11:03:08 +0200] "POST /xmlrpc.php HTTP/1.1" 200 225 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0
...
show less
Brute-Force
Web App Attack
🇦🇺
QT
2026-06-03 08:52:28
(1 week ago)
Unauthorised WordPress admin login attempted at 2026-06-03 18:52:20 +1000
Web App Attack
🇨🇿
ptlab
2026-06-03 08:45:47
(1 week ago)
Detected wp_login attack from WP-host.
Hacking
Web App Attack
🇺🇸
mnsf
2026-06-03 08:07:41
(1 week ago)
Too many Status 40X (11)
Brute-Force
Web App Attack
2026-06-03 08:00:26
(1 week ago)
2026-06-03T10:00:25.989201+02:00 zanati wp(sahpa.co.za)[3235279]: Blocked user enumeration attempt f ...
show more
2026-06-03T10:00:25.989201+02:00 zanati wp(sahpa.co.za)[3235279]: Blocked user enumeration attempt from 138.252.125.121
...
show less
Web App Attack
🇩🇪
BlueWire Hosting
2026-06-03 07:35:23
(1 week ago)
Probing websites for vulnerabilities
Web App Attack
SQL Injection
🇺🇸
TPI-Abuse
2026-06-03 07:27:57
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 138.252.125.121 (bdix121.wowbet.net): 1 in the ...
show more
(mod_security) mod_security (id:225170) triggered by 138.252.125.121 (bdix121.wowbet.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 03:27:50.511955 2026] [security2:error] [pid 17730:tid 17730] [client 138.252.125.121:34860] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fundingworkingcapital.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fundingworkingcapital.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ah_Xdj3pDTLbVzwShCajMgAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-03 06:59:01
(1 week ago)
indigi-print-merch.com.au:443 138.252.125.121 - - [03/Jun/2026:16:58:56 +1000] "GET /?author=25 HTTP ...
show more
indigi-print-merch.com.au:443 138.252.125.121 - - [03/Jun/2026:16:58:56 +1000] "GET /?author=25 HTTP/1.1" 404 374793 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36, Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
...
show less
Web App Attack