Anonymous
2026-09-11 15:35:18
(1 day ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇵🇱
mscode.pl
2026-09-11 15:11:03
(1 day ago)
Triggered Cloudflare WAF (firewallCustom) from BE.
Action taken: CHALLENGE
ASN: 396982 (Google LLC)
...
show more
Triggered Cloudflare WAF (firewallCustom) from BE.
Action taken: CHALLENGE
ASN: 396982 (Google LLC)
Protocol: HTTP/1.1 (GET method)
Zone: error-pages.mscode.pl
Endpoint: //cms/wp-includes/wlwmanifest.xml
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
show less
Bad Web Bot
🇧🇷
noconex
2026-09-11 15:10:09
(1 day ago)
Wazuh Alert | Rule ID: 100199 | Desc: Suricata: (ET SCAN WordPress Scanner Performing Multiple Reque ...
show more
Wazuh Alert | Rule ID: 100199 | Desc: Suricata: (ET SCAN WordPress Scanner Performing Multiple Requests to Windows Live Writer XML) detectado de 34.140.120.169
show less
Port Scan
Brute-Force
SSH
🇹🇷
eryilmaz
2026-09-11 15:09:16
(1 day ago)
Automated attack blocked by eryilmaz WAF/defense engine (level 1, source: auto, path: /blog/wp-inclu ...
show more
Automated attack blocked by eryilmaz WAF/defense engine (level 1, source: auto, path: /blog/wp-includes/wlwmanifest.xml)
show less
Web App Attack
Hacking
🇳🇿
Tripwire
2026-09-11 15:08:55
(1 day ago)
Scanning for exploits - //wp-includes/ID3/license.txt
Web App Attack
🇧🇪
cmbplf
2026-09-11 15:03:17
(1 day ago)
51.280 requests in 1 hour (1mo2w4d)
Brute-Force
Bad Web Bot
🇩🇪
et-a_network
2026-09-11 15:00:04
(1 day ago)
34.140.120.169 - - [11/Sep/2026:15:00:00 +0000] "GET //wp-includes/ID3/license.txt HTTP/2.0" 444 0 " ...
show more
34.140.120.169 - - [11/Sep/2026:15:00:00 +0000] "GET //wp-includes/ID3/license.txt HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" host=e-pruef.et-a.eu via=172.64.200.103 rt=0.000
34.140.120.169 - - [11/Sep/2026:15:00:00 +0000] "GET //xmlrpc.php?rsd HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" host=e-pruef.et-a.eu via=162.158.172.15 rt=0.000
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-09-11 14:53:50
(1 day ago)
10 attempts against mh_ha-misc-ban on ceres
Brute-Force
Web App Attack
🇨🇭
backslash
2026-09-11 14:33:00
(1 day ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇦
Olexiy Backend
2026-09-11 14:30:30
(1 day ago)
34.140.120.169
...
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-09-11 14:30:03
(1 day ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇷🇴
clauss
2026-09-11 14:27:35
(1 day ago)
34.140.120.169 - - [11/Sep/2026:17:27:34 +0300] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 410 ...
show more
34.140.120.169 - - [11/Sep/2026:17:27:34 +0300] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 410 436 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.140.120.169 - - [11/Sep/2026:17:27:34 +0300] "GET /web/wp-includes/wlwmanifest.xml HTTP/1.1" 410 436 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.140.120.169 - - [11/Sep/2026:17:27:34 +0300] "GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 410 436 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.140.120.169 - - [11/Sep/2026:17:27:34 +0300] "GET /wp/wp-includes/wlwmanifest.xml HTTP/1.1" 410 436 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.140.120.169 - - [11/Sep/2026:17:27:34 +0300] "GET /2020/wp-includes/wlwmanifest.xml HTTP/1.
...
show less
Web App Attack
Anonymous
2026-09-11 14:25:09
(1 day ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇬🇷
setupgr
2026-09-11 14:24:54
(1 day ago)
(mod_security) mod_security (id:11000011) triggered by 34.140.120.169 (BE/Belgium/Brussels Capital/B ...
show more
(mod_security) mod_security (id:11000011) triggered by 34.140.120.169 (BE/Belgium/Brussels Capital/Brussels/-/[AS396982 Google LLC]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Fri Sep 11 17:24:53.353342 2026] [security2:error] [pid 78211:tid 78334] [client 34.140.120.169:63943] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "googleusercontent.com" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: 169.120.140.34.bc.googleusercontent.com"] [severity "CRITICAL"] [hostname "endoscope.gr"] [uri "/"] [unique_id "aqQPNTnbAn6ieSdFQT45OAAABRc"]
show less
Port Scan
Anonymous
2026-09-11 14:16:58
(1 day ago)
34.140.120.169 - - [11/Sep/2026:16:16:57 +0200] "GET /wp-includes/ID3/license.txt HTTP/1.1" 404 6631 ...
show more
34.140.120.169 - - [11/Sep/2026:16:16:57 +0200] "GET /wp-includes/ID3/license.txt HTTP/1.1" 404 6631 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.140.120.169 - - [11/Sep/2026:16:16:57 +0200] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 6631 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.140.120.169 - - [11/Sep/2026:16:16:57 +0200] "GET /web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 6631 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.140.120.169 - - [11/Sep/2026:16:16:58 +0200] "GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 6631 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.140.120.169 - - [11/Sep/2026:16:16:58 +0200] "GET /wp/wp-includes/wlwmanifest.xml HTTP/1.1
...
show less
Brute-Force
Web App Attack