🇩🇪
ghostwarriors
2026-10-12 14:50:08
(1 week ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
maxpower
2026-10-12 14:46:40
(1 week ago)
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 34.21.49.246 (US/United States/246.49.21.34.bc ...
show more
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 34.21.49.246 (US/United States/246.49.21.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 2026/10/12 16:46:38 [error] 646490#646490: *2791421 access forbidden by rule, client: 34.21.49.246, server: fdpimmobiliare.com, request: "GET //?author=1 HTTP/2.0", host: "www.fdpimmobiliare.com"
2026/10/12 16:46:38 [error] 646482#646482: *2791419 access forbidden by rule, client: 34.21.49.246, server: fdpimmobiliare.com, request: "GET //?author=2 HTTP/2.0", host: "www.fdpimmobiliare.com"
2026/10/12 16:46:39 [error] 646490#646490: *2791421 access forbidden by rule, client: 34.21.49.246, server: fdpimmobiliare.com, request: "POST //xmlrpc.php HTTP/2.0", host: "www.fdpimmobiliare.com"
show less
Port Scan
🇮🇹
VHosting
2026-10-12 14:45:06
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
IndigoRidge
2026-10-12 14:44:20
(1 week ago)
34.21.49.246 - - [12/Oct/2026:10:44:16 -0400] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 301 4860 ...
show more
34.21.49.246 - - [12/Oct/2026:10:44:16 -0400] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 301 4860 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.21.49.246 - - [12/Oct/2026:10:44:17 -0400] "GET //xmlrpc.php?rsd HTTP/1.1" 200 5545 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.21.49.246 - - [12/Oct/2026:10:44:18 -0400] "GET //?author=1 HTTP/1.1" 404 4761 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.21.49.246 - - [12/Oct/2026:10:44:19 -0400] "GET //?author=2 HTTP/1.1" 404 4761 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.21.49.246 - - [12/Oct/2026:10:44:20 -0400] "GET //wp-json/wp/v2/users/ HTTP/1.1" 403 5500 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K
...
show less
Web App Attack
🇩🇪
yitzhaq
2026-10-12 14:42:03
(1 week ago)
34.21.49.246 - - [12/Oct/2026:16:41:59 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 516 " ...
show more
34.21.49.246 - - [12/Oct/2026:16:41:59 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 516 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.21.49.246 - - [12/Oct/2026:16:41:59 +0200] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 516 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.21.49.246 - - [12/Oct/2026:16:41:59 +0200] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 516 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.21.49.246 - - [12/Oct/2026:16:41:59 +0200] "GET //wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 516 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.21.49.246 - - [12/Oct/2026:16:41:59 +0200] "GET //website/wp-includes/wlwmanifest.xml HTTP/1.1
show less
Web App Attack
Hacking
🇩🇪
4server
2026-10-12 14:41:33
(1 week ago)
[MonOct1216:41:31.0788422026][security2:error][pid3941277:tid3941398][client34.21.49.246:0]ModSecuri ...
show more
[MonOct1216:41:31.0788422026][security2:error][pid3941277:tid3941398][client34.21.49.246:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"sisuconsulting.net\"][uri\"/xmlrpc.php\"][unique_id\"aszxm-C61U1i8Oma31o7GAAAAUo\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 14:39:58
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 34.21.49.246 (246.49.21.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 34.21.49.246 (246.49.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 10:39:54.507359 2026] [security2:error] [pid 24278:tid 24311] [client 34.21.49.246:60797] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||georgementz.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "georgementz.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aszxOvhUkDNP4PmTq2C1zwAAARM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
webanyone
2026-10-12 14:08:22
(1 week ago)
Self-declared scanner | method: GET | path: / | ua: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https ...
show more
Self-declared scanner | method: GET | path: / | ua: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com)
show less
Port Scan
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-12 13:51:22
(1 week ago)
[12/Oct/2026:16:51:21 +0300] -- 34.21.49.246 Ban reason: User-Agent CMS-Checker
Bad Web Bot
Web App Attack