🇺🇸
infra-monitor
2026-07-02 15:00:04
(1 week ago)
Automated ban via infra-monitor: wp-sensitive-paths, wordpress-probe
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 14:39:04
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 34.139.182.90 (90.182.139.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:225170) triggered by 34.139.182.90 (90.182.139.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 10:38:58.397864 2026] [security2:error] [pid 21329:tid 21329] [client 34.139.182.90:50563] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||artichokedesign.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "artichokedesign.net"] [uri "/wordpress/wp-json/wp/v2/users/"] [unique_id "akZ4ArenegKCvV2MfMVMtgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
webanyone
2026-07-02 14:30:42
(1 week ago)
Repeated 404 errors, blocked by Fail2ban in custom-404 jail
Bad Web Bot
🇩🇪
mondor.ro
2026-07-02 14:29:39
(1 week ago)
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 34.139.182.90, Reason: ...
show more
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 34.139.182.90, Reason:[(manifest) WordPress wlwmanifest.xml Attack 34.139.182.90 (US/United States/90.182.139.34.bc.googleusercontent.com): 10 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs:
show less
Port Scan
🇺🇸
TPI-Abuse
2026-07-02 14:22:47
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 34.139.182.90 (90.182.139.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:225170) triggered by 34.139.182.90 (90.182.139.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 10:22:41.889901 2026] [security2:error] [pid 7047:tid 7047] [client 34.139.182.90:57776] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||armenianpress.am|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "armenianpress.am"] [uri "/wp-json/wp/v2/users/"] [unique_id "akZ0MVmzJkPPjIeoOgbcXAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Trashware
2026-07-02 14:22:23
(1 week ago)
Vulnerability scan
Hacking
Bad Web Bot
Web App Attack
🇵🇾
armandosaucedo.me
2026-07-02 14:21:58
(1 week ago)
Threat Intelligence via ARMTI, Web Attack: GET //wp-includes/ID3/license.txt
Web App Attack
🇦🇺
screwlooseit.com.au
2026-07-02 14:14:52
(1 week ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
US/United States/90.182.139.34.bc.googleusercontent.com
Web App Attack
🇷🇺
DZBOT
2026-07-02 14:10:39
(1 week ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇨🇭
backslash
2026-07-02 14:06:00
(1 week ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇩🇪
filstal.org
2026-07-02 14:04:56
(1 week ago)
WordPress login brute-force detected.
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-07-02 13:59:14
(1 week ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇫🇷
vtchost.com
2026-07-02 13:54:42
(1 week ago)
apt.minux.cc:443 34.139.182.90 - - [02/Jul/2026:15:54:38 +0200] "GET //wp-includes/ID3/license.txt H ...
show more
apt.minux.cc:443 34.139.182.90 - - [02/Jul/2026:15:54:38 +0200] "GET //wp-includes/ID3/license.txt HTTP/1.1" 418 3960 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
apt.minux.cc:443 34.139.182.90 - - [02/Jul/2026:15:54:41 +0200] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 418 3959 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
apt.minux.cc:443 34.139.182.90 - - [02/Jul/2026:15:54:42 +0200] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 418 3960 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
...
show less
Brute-Force
🇩🇪
big-cloud.nl
2026-07-02 13:46:37
(1 week ago)
Try to access /xmlrpc.php?rsd
Web App Attack
🇨🇭
Origon
2026-07-02 13:46:17
(1 week ago)
http-probing - IP: 34.139.182.90 - time="2026-07-02T15:46:16+02:00" level=info msg="(555f66b4f6a745 ...
show more
http-probing - IP: 34.139.182.90 - time="2026-07-02T15:46:16+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-probing by ip 34.139.182.90 (US/396982) : 4h ban on Ip 34.139.182.90" module=db
show less
Web App Attack