🇩🇪
Vegascosmetics
2026-09-11 10:45:26
UTC ·
(2 months ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possible exploited host). Evidence: AttackPattern: /wp-includes/ (Match: /wp-includes/)
Hacking
Exploited Host
Web App Attack
🇫🇷
Pays d'Angoulême
2026-09-11 09:28:31
UTC ·
(2 months ago)
[Drupal AbuseIPDB module] Request path is blacklisted. /wp-includes/wlwmanifest.xml
Web App Attack
🇺🇸
integrantservices.com
2026-09-11 09:21:37
UTC ·
(2 months ago)
(wordpress) Failed wordpress login from 34.14.1.41 (BE/Belgium/41.1.14.34.bc.googleusercontent.com)
Brute-Force
🇩🇪
ghostwarriors
2026-09-11 09:20:06
UTC ·
(2 months ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇳🇱
e.fierstra
2026-09-11 09:11:05
UTC ·
(2 months ago)
excessive HTTP 404 errors
Bad Web Bot
🇧🇪
cmbplf
2026-09-11 09:01:43
UTC ·
(2 months ago)
122.929 requests in 1 hour (1mo2w5d)
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-11 09:01:22
UTC ·
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 34.14.1.41 (41.1.14.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 05:01:16.503282 2026] [security2:error] [pid 14854:tid 14854] ...
show more
(mod_security) mod_security (id:225170) triggered by 34.14.1.41 (41.1.14.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 05:01:16.503282 2026] [security2:error] [pid 14854:tid 14854] [client 34.14.1.41:58544] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.angelaknightmusic.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.angelaknightmusic.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aqPDXPV4tb_KCQ-JjSDktQAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
yitzhaq
2026-09-11 08:51:54
UTC ·
(2 months ago)
34.14.1.41 - - [11/Sep/2026:10:51:50 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 518 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.14.1.41 - - [11/Sep/2026:10: ...
show more
34.14.1.41 - - [11/Sep/2026:10:51:50 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 518 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.14.1.41 - - [11/Sep/2026:10:51:51 +0200] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 518 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.14.1.41 - - [11/Sep/2026:10:51:51 +0200] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 518 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.14.1.41 - - [11/Sep/2026:10:51:51 +0200] "GET //wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 518 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.14.1.41 - - [11/Sep/2026:10:51:51 +0200] "GET //website/wp-includes/wlwmanifest.xml HTTP/1.1" 404 518
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-11 08:43:59
UTC ·
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 34.14.1.41 (41.1.14.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 04:43:52.830075 2026] [security2:error] [pid 8735:tid 8783] [ ...
show more
(mod_security) mod_security (id:225170) triggered by 34.14.1.41 (41.1.14.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 04:43:52.830075 2026] [security2:error] [pid 8735:tid 8783] [client 34.14.1.41:61578] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||andyboynton.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "andyboynton.com"] [uri "/wordpress/wp-json/wp/v2/users/"] [unique_id "aqO_SFWHufXQqUDbOcgP-gAAAIU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
as211431.net
2026-09-11 08:31:36
UTC ·
(2 months ago)
Triggered Cloudflare WAF (firewallCustom) from BE.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: //2020/wp-includes/wlwmanifest.xml
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389. ...
show more
Triggered Cloudflare WAF (firewallCustom) from BE.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: //2020/wp-includes/wlwmanifest.xml
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇷
masterguru
2026-09-11 08:31:24
UTC ·
(2 months ago)
WordPress: User enumeration. Pattern match "(author\\\\= (88030-197)
Hacking
🇩🇪
Lino Project
2026-09-11 08:23:30
UTC ·
(2 months ago)
34.14.1.41 - - [11/Sep/2026:10:23:29 +0200] "GET //xmlrpc.php?rsd HTTP/2.0" 403 276 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
...
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Séfora Srl
2026-09-11 08:23:24
UTC ·
(2 months ago)
crowdsecurity/http-probing detected by CrowdSec
Web App Attack
🇧🇾
lns.bz
2026-09-11 08:18:20
UTC ·
(2 months ago)
Too many 404 requests [BY]
Web App Attack
🇺🇸
TPI-Abuse
2026-09-11 08:17:36
UTC ·
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 34.14.1.41 (41.1.14.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 04:17:29.409561 2026] [security2:error] [pid 20736:tid 20736] ...
show more
(mod_security) mod_security (id:225170) triggered by 34.14.1.41 (41.1.14.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 04:17:29.409561 2026] [security2:error] [pid 20736:tid 20736] [client 34.14.1.41:50686] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.andiamocomputers.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.andiamocomputers.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aqO5GUutQIWbxmfT285WCwAAAEo"]
show less
Brute-Force
Bad Web Bot
Web App Attack