Anonymous
2026-10-17 21:57:14
(1 day ago)
Fail2ban Nginx log integration.
Brute-Force
SSH
Port Scan
๐ช๐ธ
robotstxt
2026-10-17 21:31:05
(1 day ago)
158.173.74.243 - - [17/Oct/2026:21:30:31 +0000] "GET /blog/xmlrpc.php HTTP/2.0" 403 21665 "-" "Mozil ...
show more
158.173.74.243 - - [17/Oct/2026:21:30:31 +0000] "GET /blog/xmlrpc.php HTTP/2.0" 403 21665 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0" "158.173.74.243" edge="172.68.243.26"
158.173.74.243 - - [17/Oct/2026:21:30:30 +0000] "GET /wp/xmlrpc.php HTTP/2.0" 403 21734 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0" "158.173.74.243" edge="172.68.243.26"
158.173.74.243 - - [17/Oct/2026:21:30:30 +0000] "GET /wordpress/xmlrpc.php HTTP/2.0" 403 21664 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0" "158.173.74.243" edge="172.68.243.26"
158.173.74.243 - - [17/Oct/2026:21:30:31 +0000] "GET /xmlrpc.php HTTP/2.0" 403 21655 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0" "158.173.74.243" edge="172.68.243.26"
158.173.74.243 - - [17/Oct/2026:21:30:33 +0000] "GET /wp/xmlrpc.php HTTP/2.0" 403 21665 "http://ccoo.app/wp/xmlrpc.php" "Mozilla/5.0 (Windows
...
show less
Web App Attack
๐ฌ๐ง
consul.to
2026-10-17 20:34:47
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
๐ณ๐ฑ
Site.eu
2026-10-17 20:10:05
(1 day ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
๐ต๐ฑ
Budyn
2026-10-17 19:30:58
(1 day ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.space | URI: /xmlrpc.php | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
๐ฎ๐น
mgarofano80
2026-10-17 19:21:52
(1 day ago)
Brute-Force
Web App Attack
๐ฉ๐ช
maxpower
2026-10-17 19:21:45
(1 day ago)
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 158.173.74.243 (DK/Denmark/-): 3 in the last 3 ...
show more
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 158.173.74.243 (DK/Denmark/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 2026/10/17 21:21:41 [error] 3023552#3023552: *4316217 access forbidden by rule, client: 158.173.74.243, server: lasfiziosapizzeria.it, request: "GET /wordpress/xmlrpc.php HTTP/2.0", host: "lasfiziosapizzeria.it"
2026/10/17 21:21:41 [error] 3023558#3023558: *4316218 access forbidden by rule, client: 158.173.74.243, server: lasfiziosapizzeria.it, request: "GET /xmlrpc.php HTTP/2.0", host: "lasfiziosapizzeria.it"
2026/10/17 21:21:41 [error] 3023559#3023559: *4316219 access forbidden by rule, client: 158.173.74.243, server: lasfiziosapizzeria.it, request: "GET /wp/xmlrpc.php HTTP/2.0", host: "lasfiziosapizzeria.it"
show less
Port Scan
๐บ๐ธ
Starburst SysOp Team
2026-10-17 18:55:48
(1 day ago)
Malware host (X-Forwarded-For) detected by rbl.malware.expert. RBL lookup of 243.74.173.158.rbl.malw ...
show more
Malware host (X-Forwarded-For) detected by rbl.malware.expert. RBL lookup of 243.74.173.158.rbl.malware.expert succeeded at REQUEST_HEADERS:x-forwarded-for. (1001000-mnz6-3)
show less
Hacking
๐บ๐ธ
agenciahypelab.com.br
2026-10-17 18:55:24
(1 day ago)
WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER
Brute-Force
SSH
๐ณ๐ฑ
0xffffffff
2026-10-17 18:49:22
(1 day ago)
[2026-10-17 21:49:16.707484] [authz_core:error] [pid 1170:tid 138210918762176] [client 158.173.74.24 ...
show more
[2026-10-17 21:49:16.707484] [authz_core:error] [pid 1170:tid 138210918762176] [client 158.173.74.243:0] AH01630: client denied by server configuration: /var/www/*/wp , error_notes:non-dirs , URI:'/wp/xmlrpc.php'
[2026-10-17 21:49:16.710490] [authz_core:error] [pid 1172:tid 138210918762176] [client 158.173.74.243:0] AH01630: client denied by server configuration: /var/www/*/wordpress , error_notes:non-dirs , URI:'/wordpress/xmlrpc.php'
[2026-10-17 21:49:16.713059] [authz_core:error] [pid 1172:tid 138210901944000] [client 158.173.74.243:0] AH01630: client denied by server configuration: /var/www/*/blog , error_notes:non-dirs , URI:'/blog/xmlrpc.php'
[2026-10-17 21:49:18.515273] [authz_core:error] [pid 1172:tid 138211002754752] [client 158.173.74.243:0] AH01630: client denied by server configuration: /var/www/*/wordpress, referer http://*/wordpress/xmlrpc.php , error_notes:non-dirs , URI:'/wordpress/xmlrpc.php'
[2026-10-17 21:49:20.192932] [authz_core:error] [pid 1172:tid 138210910353088] [client 158.173.74.243
show less
Web App Attack
Bad Web Bot
Anonymous
2026-10-17 17:36:33
(1 day ago)
๐ฅ Web application attack detected. Vulnerability scanning and exploitation attempts identified.
Port Scan
Web App Attack
๐ช๐ธ
robotstxt
2026-10-17 17:35:43
(1 day ago)
158.173.74.243 - - [17/Oct/2026:17:35:00 +0000] "GET /wp/xmlrpc.php HTTP/2.0" 403 21655 "-" "Mozilla ...
show more
158.173.74.243 - - [17/Oct/2026:17:35:00 +0000] "GET /wp/xmlrpc.php HTTP/2.0" 403 21655 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" "158.173.74.243" edge="104.22.69.102"
158.173.74.243 - - [17/Oct/2026:17:35:00 +0000] "GET /blog/xmlrpc.php HTTP/2.0" 403 21655 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" "158.173.74.243" edge="104.22.69.102"
158.173.74.243 - - [17/Oct/2026:17:35:00 +0000] "GET /xmlrpc.php HTTP/2.0" 403 21724 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" "158.173.74.243" edge="104.22.69.102"
158.173.74.243 - - [17/Oct/2026:17:35:00 +0000] "GET /wordpress/xmlrpc.php HTTP/2.0" 403 21655 "http://ccoo.app/wordpress/xmlrpc.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" "158.173.74.243" edge
...
show less
Web App Attack
๐ซ๐ท
ELYAZ
2026-10-17 17:35:00
(1 day ago)
(y3) Failed access -byebye- from 158.173.74.243 (DK/Denmark/-): (CF_ENABLE)
Hacking
Anonymous
2026-10-17 17:34:48
(1 day ago)
Automatically blocked after 8 security events. Observed repeated web application attack probes. Sour ...
show more
Automatically blocked after 8 security events. Observed repeated web application attack probes. Source: Cloudflare security controls.
show less
Hacking
Web App Attack
๐บ๐ธ
oralunal
2026-10-17 16:26:35
(1 day ago)
IP banned by Fail2Ban in jail oral-suss access.log mvfnds
...
Bad Web Bot
Web App Attack