๐ฉ๐ช
FeG Deutschland
2026-10-08 00:16:22
(9 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
๐ง๐ท
noconex
2026-09-23 06:25:02
(2 weeks ago)
Wazuh Alert | Rule ID: 100199 | Desc: Suricata: (ET SCAN WordPress Scanner Performing Multiple Reque ...
show more
Wazuh Alert | Rule ID: 100199 | Desc: Suricata: (ET SCAN WordPress Scanner Performing Multiple Requests to Windows Live Writer XML) detectado de 142.111.152.152
show less
Port Scan
Brute-Force
SSH
๐ฎ๐น
CoreTech srl
2026-09-23 06:20:26
(2 weeks ago)
cloudlinux2 fail2ban: 2026-09-23 08:13:54,845 fail2ban.filter [1603]: INFO [plesk-wordpre ...
show more
cloudlinux2 fail2ban: 2026-09-23 08:13:54,845 fail2ban.filter [1603]: INFO [plesk-wordpress] Found 31.171.130.99 - 2026-09-23 08:13:54cloudlinux2 fail2ban: 2026-09-23 08:14:39,551 fail2ban.filter [1603]: INFO [plesk-wordpress] Found 142.111.152.48 - 2026-09-23 08:14:38cloudlinux2 fail2ban: 2026-09-23 08:14:30,211 fail2ban.filter [1603]: INFO [plesk-wordpress] Found 142.111.152.197 - 2026-09-23 08:14:30cloudlinux2 fail2ban: 2026-09-23 08:14:39,400 fail2ban.filter [1603]: INFO [plesk-wordpress] Found 142.111.152.152 - 2026-09-23 08:14:38cloudlinux2 fail2ban: 2026-09-23 08:15:10,764 fail2ban.filter [1603]: INFO [plesk-wordpress] Found 91.244.197.105 - 2026-09-23 08:15:10cloudlinux2 fail2ban: 2026-09-23 08:16:14,096 fail2ban.filter [1603]: INFO [plesk-wordpress] Found 155.2.215.63 - 2026-09-23 08:16:13cloudlinux2 fail2ban: 2026-09-23 08:16:14,249 fail2ban.filter [1603]: INFO [plesk-wordpress] Found 142.111.152.150 - 2026-09-23 08:16:13cl
show less
Web App Attack
๐ฉ๐ช
raph
2026-09-22 18:59:45
(2 weeks ago)
[Wordpress] crawler /wp-admin/*, /wp-content/*, etc.
Bad Web Bot
Web App Attack
๐ต๐ฑ
Budyn
2026-09-22 18:15:40
(2 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: git.goblinpot.tech | URI: //xmlrpc.php?rsd | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
๐ณ๐ฑ
Savvii
2026-09-22 18:12:34
(2 weeks ago)
10 attempts against mh-misc-ban on mars
Web App Attack
๐ฉ๐ช
EGP Abuse Dept
2026-09-22 01:02:20
(2 weeks ago)
Scanning for web/db/file exploits on www.hygion.nl
SQL Injection
Bad Web Bot
Web App Attack
๐ฉ๐ช
Hazzard
2026-09-18 10:38:16
(2 weeks ago)
(wordpress) Failed wordpress login from 142.111.152.152 (US/United States/Texas/Houston/-/[redacted] ...
show more
(wordpress) Failed wordpress login from 142.111.152.152 (US/United States/Texas/Houston/-/[redacted]): (CF_ENABLE)
show less
Brute-Force
๐ณ๐ฑ
Site.eu
2026-09-17 17:47:28
(2 weeks ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
๐บ๐ธ
TPI-Abuse
2026-09-17 05:44:00
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 142.111.152.152 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 142.111.152.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 01:43:53.114016 2026] [security2:error] [pid 5002:tid 5002] [client 142.111.152.152:42997] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||weddingmusicguitar.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "weddingmusicguitar.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aqt-GZpun6jMMHHAHs-yaAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
IndigoRidge
2026-09-16 14:27:25
(3 weeks ago)
142.111.152.152 - - [16/Sep/2026:10:24:49 -0400] "POST /wp-login.php HTTP/1.1" 200 13450 "-" "Mozill ...
show more
142.111.152.152 - - [16/Sep/2026:10:24:49 -0400] "POST /wp-login.php HTTP/1.1" 200 13450 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/129.0.0.0 Safari/537.36"
142.111.152.152 - - [16/Sep/2026:10:25:40 -0400] "POST /wp-login.php HTTP/1.1" 200 13450 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/129.0.0.0 Safari/537.36"
142.111.152.152 - - [16/Sep/2026:10:26:15 -0400] "POST /wp-login.php HTTP/1.1" 200 13450 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; rv:143.0) Gecko/20100101 Firefox/143.0"
142.111.152.152 - - [16/Sep/2026:10:26:49 -0400] "POST /wp-login.php HTTP/1.1" 200 13450 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/129.0.0.0 Safari/537.36"
142.111.152.152 - - [16/Sep/2026:10:27:24 -0400] "POST /wp-login.php HTTP/1.1" 200 13450 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; rv:143.0) Gecko/20100101 Firefox/143.0"
...
show less
Web App Attack
๐บ๐ธ
nyt
2026-09-12 00:51:27
(3 weeks ago)
Repeated WordPress login POSTs blocked by WAF (3 in 6h)
Brute-Force
Web App Attack
Anonymous
2026-09-11 13:20:54
(3 weeks ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
๐ง๐ช
cmbplf
2026-09-09 00:35:12
(4 weeks ago)
4.216 POST requests with url.path */wp-login.php
Brute-Force
Bad Web Bot
๐ฉ๐ช
FeG Deutschland
2026-09-08 17:28:08
(4 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack