🇩🇪
dennis.reinitz
2026-06-21 10:35:00
(1 week ago)
~700 Brute Force Attacks on a Wordpress Dashboard within 1 month
Brute-Force
🇬🇧
Marten Mark
2026-06-02 10:24:03
(3 weeks ago)
2026/06/02 10:23:58 [error] 3752995#3752995: *721289 limiting requests, excess: 3.960 by zone "wp_lo ...
show more
2026/06/02 10:23:58 [error] 3752995#3752995: *721289 limiting requests, excess: 3.960 by zone "wp_login_zone", client: 161.118.204.180, server: bonus.cfi.co, request: "GET /wp-login.php?redirect_to=https%3A%2F%2Fbonus.cfi.co%2Fwp-admin%2Findex.php&reauth=1 HTTP/2.0", host: "bonus.cfi.co", referrer: "https://bonus.cfi.co/wp-login.php"
2026/06/02 10:23:58 [error] 3752995#3752995: *721282 limiting requests, excess: 3.952 by zone "wp_login_zone", client: 161.118.204.180, server: bonus.cfi.co, request: "GET /wp-login.php?redirect_to=https%3A%2F%2Fbonus.cfi.co%2Fwp-admin%2Findex.php&reauth=1 HTTP/2.0", host: "bonus.cfi.co", referrer: "https://bonus.cfi.co/wp-login.php"
2026/06/02 10:23:59 [error] 3752995#3752995: *721280 limiting requests, excess: 3.945 by zone "wp_login_zone", client: 161.118.204.180, server: bonus.cfi.co, request: "GET /wp-login.php?redirect_to=https%3A%2F%2Fbonus.cfi.co%2Fwp-admin%2Findex.php&reauth=1 HTTP/2.0", host: "bonus.cfi.co", referrer: "https://bonus.cfi.co/wp-log
...
show less
Brute-Force
Web App Attack
2026-06-01 18:24:37
(3 weeks ago)
Aggressive web scan
Web App Attack
🇩🇪
webanyone
2026-06-01 15:15:21
(3 weeks ago)
Repeated 404 errors, blocked by Fail2ban in custom-404 jail
Bad Web Bot
🇺🇸
mind5t0rm
2026-06-01 15:13:57
(3 weeks ago)
(WPLOGIN) WP Login Attack 161.118.204.180 (SG/Singapore/-): 3 in the last 3600 secs; Ports: *; Direc ...
show more
(WPLOGIN) WP Login Attack 161.118.204.180 (SG/Singapore/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 161.118.204.180 - - [01/Jun/2026:22:13:38 +0700] "GET /wp-login.php HTTP/2.0" 200 2539 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36"
161.118.204.180 - - [01/Jun/2026:22:13:51 +0700] "POST /wp-login.php HTTP/2.0" 200 2695 "https://healthy-skin.me/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36"
161.118.204.180 - - [01/Jun/2026:22:13:53 +0700] "GET /wp-login.php?redirect_to=https%3A%2F%2Fhealthy-skin.me%2Fwp-admin%2Findex.php&reauth=1 HTTP/2.0" 200 2551 "https://healthy-skin.me/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36"
show less
Port Scan
🇺🇸
jormaster3k
2026-06-01 12:43:35
(3 weeks ago)
Attack against WordPress
Web App Attack
🇮🇩
soc-yk
2026-06-01 12:42:11
(3 weeks ago)
Type: suspicious_network_activity
Threat: unknown
Risk: 68
Events: 63095
Evidence:
- Persistent sus ...
show more
Type: suspicious_network_activity
Threat: unknown
Risk: 68
Events: 63095
Evidence:
- Persistent suspicious network activity detected
- Repeated hostile operational behavior observed
- Multi-event operational persistence identified
- Threat escalation behavior observed
show less
Port Scan
Hacking
🇳🇱
Savvii
2026-06-01 05:51:27
(3 weeks ago)
10 attempts against mh-misc-ban on pf221108
Web App Attack
🇮🇩
soc-yk
2026-06-01 04:42:11
(3 weeks ago)
Type: credential_attack
Threat: unknown
Risk: 68
Events: 63095
Evidence:
- Repeated authentication ...
show more
Type: credential_attack
Threat: unknown
Risk: 68
Events: 63095
Evidence:
- Repeated authentication attack activity detected
- Credential abuse behavior observed
- Multi-event operational persistence identified
- Threat escalation behavior observed
show less
Brute-Force
SSH
🇬🇧
noise.agency
2026-05-31 21:11:04
(3 weeks ago)
(wordpress) Failed wordpress login from 161.118.204.180 (SG/Singapore/-)
Brute-Force
2026-05-31 16:29:48
(3 weeks ago)
Aggressive web scan
Web App Attack
🇮🇩
soc-yk
2026-05-31 16:18:10
(3 weeks ago)
Type: web_scanning
Threat: unknown
Risk: 68
Events: 88712
Evidence:
- Automated hostile web probing ...
show more
Type: web_scanning
Threat: unknown
Risk: 68
Events: 88712
Evidence:
- Automated hostile web probing detected
- Repeated web scanning activity observed
- Multi-event operational persistence identified
show less
Web App Attack
🇺🇸
mind5t0rm
2026-05-31 08:41:35
(4 weeks ago)
(WPLOGIN) WP Login Attack 161.118.204.180 (SG/Singapore/-): 3 in the last 3600 secs; Ports: *; Direc ...
show more
(WPLOGIN) WP Login Attack 161.118.204.180 (SG/Singapore/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 161.118.204.180 - - [31/May/2026:15:41:29 +0700] "GET /wp-login.php HTTP/2.0" 200 2572 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Safari/605.1.15"
161.118.204.180 - - [31/May/2026:15:41:32 +0700] "POST /wp-login.php HTTP/2.0" 200 2723 "https://guruhospitality.com/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:93.0) Gecko/20100101 Firefox/93.0"
161.118.204.180 - - [31/May/2026:15:41:34 +0700] "GET /wp-login.php?redirect_to=https%3A%2F%2Fguruhospitality.com%2Fwp-admin%2Findex.php&reauth=1 HTTP/2.0" 200 2576 "https://guruhospitality.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Safari/605.1.15"
show less
Port Scan
🇧🇪
cmbplf
2026-05-31 08:09:42
(4 weeks ago)
3.062 requests from abuseipdb.com blacklisted IP (6mos3w6d)
Brute-Force
Bad Web Bot
🇧🇷
Sipo Chutão
2026-05-31 03:00:01
(4 weeks ago)
wp-admin/
Hacking