๐ฉ๐ช
ghostwarriors
2026-09-13 11:50:04
(1 week ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
๐ง๐ช
cmbplf
2026-09-13 11:43:51
(1 week ago)
10.545 requests with url.path */xmlrpc.php
10.456 requests with url.path //xmlrpc.php
2.641 reque ...
show more
10.545 requests with url.path */xmlrpc.php
10.456 requests with url.path //xmlrpc.php
2.641 requests with url.path */wp-includes/wlwmanifest.xml
show less
Brute-Force
Bad Web Bot
๐บ๐ธ
TPI-Abuse
2026-09-13 11:27:26
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 34.26.15.130 (130.15.26.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 34.26.15.130 (130.15.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 07:27:18.011881 2026] [security2:error] [pid 10416:tid 10416] [client 34.26.15.130:58408] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.fltsiminc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.fltsiminc.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aqaIlvTdkDtcIdgyhiLG_QAAACs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฉ๐ช
big-cloud.nl
2026-09-13 11:24:03
(1 week ago)
Try to access /xmlrpc.php?rsd
Web App Attack
๐ฉ๐ช
ger-stg-sifi1
2026-09-13 11:22:17
(1 week ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
๐ฉ๐ช
yitzhaq
2026-09-13 11:22:04
(1 week ago)
34.26.15.130 - - [13/Sep/2026:13:22:00 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 514 " ...
show more
34.26.15.130 - - [13/Sep/2026:13:22:00 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 514 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.26.15.130 - - [13/Sep/2026:13:22:01 +0200] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 514 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.26.15.130 - - [13/Sep/2026:13:22:01 +0200] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 514 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.26.15.130 - - [13/Sep/2026:13:22:00 +0200] "GET / HTTP/1.1" 301 551 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.26.15.130 - - [13/Sep/2026:13:22:00 +0200] "GET / HTTP/1.1" 200 6272 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.
show less
Web App Attack
Hacking
๐จ๐ญ
backslash
2026-09-13 11:21:06
(1 week ago)
block ruleset WAF detection and high score on abuseIPDB 149EB1B42C242111FADBBC2EF8F90219570691E1
Bad Web Bot
๐ณ๐ฑ
e.fierstra
2026-09-13 11:20:17
(1 week ago)
excessive HTTP 404 errors
Bad Web Bot
Anonymous
2026-09-13 11:18:19
(1 week ago)
[redacted] 34.26.15.130 - - [13/Sep/2026:13:18:10 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "M ...
show more
[redacted] 34.26.15.130 - - [13/Sep/2026:13:18:10 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
[redacted] 34.26.15.130 - - [13/Sep/2026:13:18:11 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
[redacted] 34.26.15.130 - - [13/Sep/2026:13:18:12 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
[redacted] 34.26.15.130 - - [13/Sep/2026:13:18:13 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
[redacted] 34.26.15.130 - - [13/Sep/2026:13:18:14 +0200] "POST //xmlrpc.php HTTP/1
...
show less
Hacking
Web App Attack
๐ซ๐ท
fineservice
2026-09-13 11:16:50
(1 week ago)
PrestaShop Security Module: WordPress probe path detected
Web App Attack
๐ซ๐ท
largo-it.net
2026-09-13 11:14:54
(1 week ago)
[13/Sep/2026:13:14:51.016] HTTP 404 - GET /fr//wp-includes/wlwmanifest.xml
[13/Sep/2026:13:14:51.188 ...
show more
[13/Sep/2026:13:14:51.016] HTTP 404 - GET /fr//wp-includes/wlwmanifest.xml
[13/Sep/2026:13:14:51.188] HTTP 404 - GET /fr//xmlrpc.php?rsd
[13/Sep/2026:13:14:52.231] HTTP 404 - GET /fr//blog/wp-includes/wlwmanifest.xml
[13/Sep/2026:13:14:52.696] HTTP 404 - GET /fr//web/wp-includes/wlwmanifest.xml
[13/Sep/2026:13:14:52.848] HTTP 404 - GET /fr//wordpress/wp-includes/wlwmanifest.xml
[13/Sep/2026:13:14:53.023] HTTP 404 - GET /fr//website/wp-includes/wlwmanifest.xml
[13/Sep/2026:13:14:53.291] HTTP 404 - GET /fr//wp/wp-includes/wlwmanifest.xml
[13/Sep/2026:13:14:53.545] HTTP 404 - GET /fr//news/wp-includes/wlwmanifest.xml
show less
Hacking
Bad Web Bot
Web App Attack
๐ฉ๐ช
FeG Deutschland
2026-09-13 10:56:58
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
๐ฉ๐ช
maxpower
2026-09-13 10:54:43
(1 week ago)
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 34.26.15.130 (US/United States/130.15.26.34.bc ...
show more
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 34.26.15.130 (US/United States/130.15.26.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 2026/09/13 12:54:26 [error] 2764317#2764317: *380098 access forbidden by rule, client: 34.26.15.130, server: fdpimmobiliare.com, request: "GET //?author=1 HTTP/2.0", host: "www.fdpimmobiliare.com"
2026/09/13 12:54:27 [error] 2764309#2764309: *380103 access forbidden by rule, client: 34.26.15.130, server: fdpimmobiliare.com, request: "GET //?author=2 HTTP/2.0", host: "www.fdpimmobiliare.com"
2026/09/13 12:54:27 [error] 2764317#2764317: *380098 access forbidden by rule, client: 34.26.15.130, server: fdpimmobiliare.com, request: "GET //?author=3 HTTP/2.0", host: "www.fdpimmobiliare.com"
show less
Port Scan
๐ซ๐ท
Jager
2026-09-13 10:52:51
(1 week ago)
Blocked by CrowdSec on homelab for scenario: crowdsecurity/http-probing
Brute-Force
Port Scan
Web App Attack
๐ฎ๐น
VHosting
2026-09-13 10:50:03
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack