🇩🇪
LRob
2026-11-14 04:35:11
UTC ·
(6 seconds ago)
WordPress attack-tool calls | method: POST | path: /xmlrpc.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.2151.9
Web App Attack
Hacking
🇬🇧
venus.launch.bz
2026-11-14 04:23:55
UTC ·
(11 minutes ago)
(wpscan) WordPress probe detected from 201.79.111.2 (SG/Singapore/-)
Hacking
🇺🇸
TPI-Abuse
2026-11-14 03:16:11
UTC ·
(1 hour ago)
(mod_security) mod_security (id:225170) triggered by 201.79.111.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 22:16:06.230993 2026] [security2:error] [pid 28713:tid 28713] [client 201.79.111.2:60507] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 201.79.111.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 22:16:06.230993 2026] [security2:error] [pid 28713:tid 28713] [client 201.79.111.2:60507] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fltsiminc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fltsiminc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avfSdjYfIombraay2sgSzAAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-11-13 23:05:23
UTC ·
(5 hours ago)
Xmlrpc Caught (6)
Too many Status 40X (11)
Brute-Force
Web App Attack
🇫🇷
masterguru
2026-11-13 18:11:56
UTC ·
(10 hours ago)
WordPress: User enumeration. Pattern match "(author\\\\= (88030-193)
Hacking
🇭🇺
kranem
2026-11-13 18:01:13
UTC ·
(10 hours ago)
Triggered Cloudflare WAF from SG.
Action taken: BLOCK
ASN: 14061 (DigitalOcean, LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /test/wp-includes/js/json2.js
Timestamp: 2026-11-13T15:41:06Z
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) A ...
show more
Triggered Cloudflare WAF from SG.
Action taken: BLOCK
ASN: 14061 (DigitalOcean, LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /test/wp-includes/js/json2.js
Timestamp: 2026-11-13T15:41:06Z
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
show less
Bad Web Bot
🇧🇷
ICS Labs
2026-11-13 16:49:25
UTC ·
(11 hours ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-13 UTC.
Brute-Force
🇨🇭
backslash
2026-11-13 13:48:00
UTC ·
(14 hours ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
IndigoRidge
2026-11-13 13:30:02
UTC ·
(15 hours ago)
201.79.111.2 - - [13/Nov/2026:08:28:01 -0500] "GET /?author=1 HTTP/1.1" 301 4798 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.85 Safari/537.36"
201.79.111.2 - - [13/Nov/2026:08:28:35 -0500] " ...
show more
201.79.111.2 - - [13/Nov/2026:08:28:01 -0500] "GET /?author=1 HTTP/1.1" 301 4798 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.85 Safari/537.36"
201.79.111.2 - - [13/Nov/2026:08:28:35 -0500] "GET /author/randy_461d7ds3/ HTTP/1.1" 200 53707 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.85 Safari/537.36"
201.79.111.2 - - [13/Nov/2026:08:29:49 -0500] "GET /?author=2 HTTP/1.1" 301 4791 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.2277.83"
201.79.111.2 - - [13/Nov/2026:08:29:50 -0500] "GET /author/sirrona/ HTTP/1.1" 200 49679 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.2277.83"
201.79.111.2 - - [13/Nov/2026:08:30:01 -0500] "GET /?author=3 HTTP/1.1" 301 4788 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Apple
...
show less
Web App Attack
🇫🇷
masterguru
2026-11-13 12:03:54
UTC ·
(16 hours ago)
Content-Type header missing from request with non-zero Content-Length. Operator EQ matched 0 at REQUEST_HEADERS. (920340-201)
Hacking
🇩🇪
ghostwarriors
2026-11-13 10:50:07
UTC ·
(17 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇧🇪
taivas.nl
2026-11-13 10:32:08
UTC ·
(18 hours ago)
Wordpress_xmlrpc_attack
Bad Web Bot
🇩🇪
throny
2026-11-13 10:30:33
UTC ·
(18 hours ago)
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15) Gecko/20100101 Firefox/121.0
Requested, e.g.:
- ...
show more
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15) Gecko/20100101 Firefox/121.0
Requested, e.g.:
- [REDACTED]/wp-includes/js/json2.js
show less
Web App Attack
🇮🇹
VHosting
2026-11-13 10:00:10
UTC ·
(18 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
maxasp.net
2026-11-13 09:31:37
UTC ·
(19 hours ago)
Failed WP Login Attempts 5 DDoS Count 5
Brute-Force
