🇺🇸
mnsf
2026-09-03 17:05:20
(6 hours ago)
Abuse Detected (11)
Brute-Force
Web App Attack
2026-09-03 16:56:35
(7 hours ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇧🇪
cmbplf
2026-09-03 16:55:06
(7 hours ago)
11.642 requests with url.path */xmlrpc.php
11.381 requests with url.path //xmlrpc.php
5.810 reque ...
show more
11.642 requests with url.path */xmlrpc.php
11.381 requests with url.path //xmlrpc.php
5.810 requests with url.path */wp-includes/wlwmanifest.xml
show less
Brute-Force
Bad Web Bot
🇩🇪
FeG Deutschland
2026-09-03 16:35:33
(7 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 27
Exploited Host
Web App Attack
🇩🇪
ger-stg-sifi1
2026-09-03 16:32:26
(7 hours ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
hidemail.app
2026-09-03 16:30:11
(7 hours ago)
Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto ...
show more
Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban.
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-03 16:21:03
(7 hours ago)
(mod_security) mod_security (id:225170) triggered by 34.21.22.245 (245.22.21.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 34.21.22.245 (245.22.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 03 12:20:55.855490 2026] [security2:error] [pid 17744:tid 17744] [client 34.21.22.245:65292] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.darkalleyproductions.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.darkalleyproductions.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "apmeZ_l0qNnfySkYBichCwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-03 16:12:10
(7 hours ago)
CrowdSec blocked IP for crowdsecurity/http-probing on vps_agent
Web App Attack
🇩🇪
big-cloud.nl
2026-09-03 16:06:00
(7 hours ago)
Try to access /xmlrpc.php?rsd
Web App Attack
🇳🇱
ipoac.nl
2026-09-03 16:05:59
(7 hours ago)
-:443 34.21.22.245 - - [03/Sep/2026:18:05:57 +0200] - "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 4 ...
show more
-:443 34.21.22.245 - - [03/Sep/2026:18:05:57 +0200] - "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 403 1967 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-03 15:57:55
(7 hours ago)
(mod_security) mod_security (id:225170) triggered by 34.21.22.245 (245.22.21.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 34.21.22.245 (245.22.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 03 11:57:50.746385 2026] [security2:error] [pid 551:tid 551] [client 34.21.22.245:51086] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.knoxworx.shop|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.knoxworx.shop"] [uri "/wp-json/wp/v2/users/"] [unique_id "apmY_qKXvK8VtpzXj3jbNwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
maxpower
2026-09-03 15:52:43
(8 hours ago)
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 34.21.22.245 (US/United States/245.22.21.34.bc ...
show more
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 34.21.22.245 (US/United States/245.22.21.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 2026/09/03 17:52:37 [error] 1726998#1726998: *2443920 access forbidden by rule, client: 34.21.22.245, server: kleos81.com, request: "GET //xmlrpc.php?rsd HTTP/1.1", host: "kleos81.com"
2026/09/03 17:52:38 [error] 1726998#1726998: *2443920 access forbidden by rule, client: 34.21.22.245, server: kleos81.com, request: "GET //?author=1 HTTP/1.1", host: "kleos81.com"
2026/09/03 17:52:38 [error] 1726998#1726998: *2443920 access forbidden by rule, client: 34.21.22.245, server: kleos81.com, request: "GET //?author=2 HTTP/1.1", host: "kleos81.com"
show less
Port Scan
🇦🇺
Klaverstyn
2026-09-03 15:52:00
(8 hours ago)
Repeated 403 Forbidden responses
Web App Attack
🇫🇷
pm33
2026-09-03 15:47:08
(8 hours ago)
Excessive crawling HTTP 404
Web App Attack
🇨🇭
zynex
2026-09-03 15:41:27
(8 hours ago)
URL Probing: /2019/wp-includes/wlwmanifest.xml
Web App Attack