🇩🇪
klaus_ph
2026-09-28 00:31:28
UTC ·
(1 month ago)
2026-09-27 01:03:10,378 fail2ban.actions [8144]: NOTICE [ipblocklist] Ban 34.172.49.95
...
Bad Web Bot
🇩🇪
klaus_ph
2026-09-27 03:33:08
UTC ·
(1 month ago)
2026-09-26 00:48:54,251 fail2ban.actions [594716]: NOTICE [ipblocklist] Ban 34.172.49.95
...
Bad Web Bot
🇭🇺
DumaNet
2026-09-25 05:36:00
UTC ·
(1 month ago)
WordPress (CMS) attack attempts.
Date: 2026 Sep 24. 12:17:21
Source IP: 34.172.49.95
Portion of the log(s):
34.172.49.95 - [24/Sep/2026:12:17:21 +0200] "GET /site/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; ...
show more
WordPress (CMS) attack attempts.
Date: 2026 Sep 24. 12:17:21
Source IP: 34.172.49.95
Portion of the log(s):
34.172.49.95 - [24/Sep/2026:12:17:21 +0200] "GET /site/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.172.49.95 - [24/Sep/2026:12:17:21 +0200] "GET /test/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.172.49.95 - [24/Sep/2026:12:17:21 +0200] "GET /wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.172.49.95 - [24/Sep/2026:12:17:21 +0200] "GET /shop/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
show less
Web App Attack
🇧🇷
radardatelecom
2026-09-24 22:25:43
UTC ·
(1 month ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
2026-09-24 21:57:26
UTC ·
(1 month ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
2026-09-24 12:17:16
UTC ·
(1 month ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-24 10:39:40
UTC ·
(1 month ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇳🇱
Savvii
2026-09-24 10:37:07
UTC ·
(1 month ago)
10 attempts against mh-misc-ban on frost
Web App Attack
2026-09-24 10:35:19
UTC ·
(1 month ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇩🇪
Viveronese
2026-09-24 10:18:31
UTC ·
(1 month ago)
HTTP vulnerability scanning
Web App Attack
🇦🇱
router.al
2026-09-24 10:07:50
UTC ·
(1 month ago)
09/24/2026-10:07:50.565977 34.172.49.95 Protocol: 6 GPL WEB_SERVER 403 Forbidden
Port Scan
🇩🇪
sprobst76
2026-09-24 10:06:31
UTC ·
(1 month ago)
Blocked by Traefik Dashboard. Reason: Auto-blocked: AbuseIPDB: 92% score, 16 reports
Web App Attack
Hacking
🇪🇸
pipeline.es
2026-09-24 10:06:27
UTC ·
(1 month ago)
Web scanning / probing for vulnerable paths | URL: //site/wp-includes/wlwmanifest.xml | Evidence: altovolta.es 34.172.49.95 - - [24/Sep/2026:11:38:03 +0200] \"GET //site/wp-includes/wlwmanifest.xml HTTP/1.1\" 404 230 \"-\" \"Mozilla/5.0 (Windows NT 1 ...
show more
Web scanning / probing for vulnerable paths | URL: //site/wp-includes/wlwmanifest.xml | Evidence: altovolta.es 34.172.49.95 - - [24/Sep/2026:11:38:03 +0200] \"GET //site/wp-includes/wlwmanifest.xml HTTP/1.1\" 404 230 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36\" GEOIP_COUNTRY_CODE=US | ASN: GOOGLE-CLOUD-PLATFORM | Country: US
show less
Port Scan
Web App Attack
🇧🇬
HighWay
2026-09-24 10:04:31
UTC ·
(1 month ago)
34.172.49.95 - - [24/Sep/2026:10:04:26 +0000] "GET //wp-includes/ID3/license.txt HTTP/1.1" 404 4756 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.172.49.95 - - [24/Sep/2026 ...
show more
34.172.49.95 - - [24/Sep/2026:10:04:26 +0000] "GET //wp-includes/ID3/license.txt HTTP/1.1" 404 4756 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.172.49.95 - - [24/Sep/2026:10:04:26 +0000] "GET //feed/ HTTP/1.1" 404 770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.172.49.95 - - [24/Sep/2026:10:04:26 +0000] "GET //xmlrpc.php?rsd HTTP/1.1" 404 770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.172.49.95 - - [24/Sep/2026:10:04:26 +0000] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.172.49.95 - - [24/Sep/2026:10:04:27 +0000] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)
...
show less
Bad Web Bot
Web App Attack
🇩🇪
mondor.ro
2026-09-24 10:02:23
UTC ·
(1 month ago)
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 34.172.49.95, Reason:[(manifest) WordPress wlwmanifest.xml Attack 34.172.49.95 (US/United States/95.49.172.34.bc.googleusercontent.com): 10 in the last 3600 secs]; Ports: * ...
show more
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 34.172.49.95, Reason:[(manifest) WordPress wlwmanifest.xml Attack 34.172.49.95 (US/United States/95.49.172.34.bc.googleusercontent.com): 10 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs:
show less
Port Scan
