🇫🇷
masterguru
2026-09-27 18:55:22
(2 days ago)
wp-login request blocked, no referer. Pattern match "wp-login.php" at REQUEST_URI. (88020-201)
Hacking
🇳🇱
Site.eu
2026-09-27 12:10:09
(3 days ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇩🇪
Blexyel
2026-09-27 03:32:26
(3 days ago)
188.213.202.23 - - [27/Sep/2026:05:32:26 +0200] "GET //wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404 ...
show more
188.213.202.23 - - [27/Sep/2026:05:32:26 +0200] "GET //wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404 5278 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "cloud.phoenixts.eu"
...
show less
Brute-Force
Web App Attack
🇮🇱
Dolphi
2026-09-27 03:30:02
(3 days ago)
POST //xmlrpc.php
Brute-Force
Web App Attack
🇩🇪
Blexyel
2026-09-27 02:56:54
(3 days ago)
188.213.202.23 - - [27/Sep/2026:04:56:54 +0200] "GET /shop/wp-includes/wlwmanifest.xml HTTP/1.1" 404 ...
show more
188.213.202.23 - - [27/Sep/2026:04:56:54 +0200] "GET /shop/wp-includes/wlwmanifest.xml HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
...
show less
Brute-Force
Web App Attack
🇲🇽
octageeks.com
2026-09-24 04:10:46
(6 days ago)
Wordpress malicious attack:[octaflood]
Web App Attack
🇵🇱
Budyn
2026-09-24 03:22:02
(6 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: elastic.sweetpuddingtrap.top | URI: //xmlrpc.php?rsd | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇬🇧
SCLwebadministrator
2026-09-23 07:51:00
(1 week ago)
Bruteforce WordPress logins
Brute-Force
Web App Attack
Hacking
🇺🇸
ipblock.com
2026-09-23 02:46:00
(1 week ago)
IPBlock protected site ID [3390-wh].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-09-23 01:36:25
(1 week ago)
WP Armour Plugin detection
Web Spam
Brute-Force
🇫🇷
LRob
2026-09-22 22:01:06
(1 week ago)
This address is trying passwords on WordPress logins we host — through the login page or xmlrpc.php, ...
show more
This address is trying passwords on WordPress logins we host — through the login page or xmlrpc.php, often across several sites — for accounts it does not own. This is credential brute force or credential stuffing, the way sites get hijacked to spread malware and spam; blocked. Please check the machine for malware or an attack tool. | path: /wp-login.php | 2026-09-22 22:01 UTC
show less
Brute-Force
Web App Attack
🇫🇷
tecnicorioja
2026-09-22 22:00:46
(1 week ago)
wp-login attack [22/Sep/2026:21:16:51
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 03:52:21
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 188.213.202.23 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 188.213.202.23 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:52:13.336776 2026] [security2:error] [pid 28990:tid 29019] [client 188.213.202.23:55857] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||seguroslugo.soluciona.biz|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "seguroslugo.soluciona.biz"] [uri "/blog/wp-json/wp/v2/users/"] [unique_id "arCp7YiQ-IJzhNJ53KtrwwAAAFc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-09-19 13:55:55
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: idp.dont-eat-the-pudding.online | URI: //xmlrpc.php?rsd | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
2026-09-19 08:03:53
(1 week ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack