🇳🇱
homeshowdomain.nl
2026-02-25 22:59:39
UTC ·
(8 months ago)
Auto-ban: 218 malicious requests on 2026-02-24 (e.g., env/backup probes, brute-force, or error bursts).
Web App Attack
SSH
Hacking
🇦🇹
neo72
2026-02-24 14:34:47
UTC ·
(8 months ago)
Detected malicious activity - bulk block
Brute-Force
Web App Attack
🇸🇪
nekopavel
2026-02-24 12:42:13
UTC ·
(8 months ago)
34.31.161.72 - - [24/Feb/2026:13:42:11 +0100]"GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 123848"-" mishashto.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36""0.636" "0.001" ...
show more
34.31.161.72 - - [24/Feb/2026:13:42:11 +0100]"GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 123848"-" mishashto.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36""0.636" "0.001""Council Bluffs" "US"
34.31.161.72 - - [24/Feb/2026:13:42:11 +0100]"GET //xmlrpc.php?rsd HTTP/1.1" 404 123809"-" mishashto.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36""0.133" "0.001""Council Bluffs" "US"
34.31.161.72 - - [24/Feb/2026:13:42:11 +0100]"GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 123863"-" mishashto.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36""0.158" "0.000""Council Bluffs" "US"
...
show less
Hacking
Bad Web Bot
Web App Attack
🇵🇱
webadmin
2026-02-24 12:40:53
UTC ·
(8 months ago)
2026/02/24 13:40:52 [error] 3499460#3499460: *96573 directory index of "/var/www/saisolutions/" is forbidden, client: 34.31.161.72, server: mail.saisolutions.com.pl,, request: "GET / HTTP/1.1", host: "pm.saisolutions.pl"
2026/02/24 13:40:53 [error] 3 ...
show more
2026/02/24 13:40:52 [error] 3499460#3499460: *96573 directory index of "/var/www/saisolutions/" is forbidden, client: 34.31.161.72, server: mail.saisolutions.com.pl,, request: "GET / HTTP/1.1", host: "pm.saisolutions.pl"
2026/02/24 13:40:53 [error] 3499460#3499460: *96573 directory index of "/var/www/saisolutions/" is forbidden, client: 34.31.161.72, server: mail.saisolutions.com.pl,, request: "GET / HTTP/1.1", host: "pm.saisolutions.pl"
2026/02/24 13:40:53 [error] 3499460#3499460: *96573 open() "/var/www/saisolutions/wp-includes/wlwmanifest.xml" failed (2: No such file or directory), client: 34.31.161.72, server: mail.saisolutions.com.pl,, request: "GET /wp-includes/wlwmanifest.xml HTTP/1.1", host: "pm.saisolutions.pl"
2026/02/24 13:40:53 [error] 3499460#3499460: *96573 open() "/var/www/saisolutions/xmlrpc.php" failed (2: No such file or directory), client: 34.31.161.72, server: mail.saisolutions.com.pl,, request: "GET /xmlrpc.php?rsd HTTP/1.1", host: "pm.saisolutions.pl"
2026/02/24 1
...
show less
Web App Attack
🇳🇿
Antinson
2026-02-24 12:26:44
UTC ·
(8 months ago)
High error rate and elevated request volume targeting cPanel servers
Bad Web Bot
🇺🇸
kosada.com
2026-02-24 12:22:19
UTC ·
(8 months ago)
Web vulnerability probing: /website/wp-includes/wlwmanifest.xml
Web App Attack
🇺🇸
TPI-Abuse
2026-02-24 12:16:28
UTC ·
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 34.31.161.72 (72.161.31.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 24 07:16:20.917873 2026] [security2:error] [pid 10797:tid 10 ...
show more
(mod_security) mod_security (id:225170) triggered by 34.31.161.72 (72.161.31.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 24 07:16:20.917873 2026] [security2:error] [pid 10797:tid 10797] [client 34.31.161.72:58317] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||primacomm.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "primacomm.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aZ2WlKEAdbFzzrzC8BR75QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Lino Project
2026-02-24 12:13:17
UTC ·
(8 months ago)
34.31.161.72 - - [24/Feb/2026:13:13:15 +0100] "GET //xmlrpc.php?rsd HTTP/1.1" 403 657 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.31.161.72 - - [24/Feb/2026:13:13:16 +01 ...
show more
34.31.161.72 - - [24/Feb/2026:13:13:15 +0100] "GET //xmlrpc.php?rsd HTTP/1.1" 403 657 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.31.161.72 - - [24/Feb/2026:13:13:16 +0100] "GET //?author=1 HTTP/1.1" 403 657 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
aranguren.org
2026-02-24 12:12:11
UTC ·
(8 months ago)
34.31.161.72 - - [24/Feb/2026:23:12:09 +1100] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404 992 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.31.161.72 - - [24/Feb/2026: ...
show more
34.31.161.72 - - [24/Feb/2026:23:12:09 +1100] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404 992 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.31.161.72 - - [24/Feb/2026:23:12:10 +1100] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 992 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.31.161.72 - - [24/Feb/2026:23:12:10 +1100] "GET /web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 992 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
...
show less
Web App Attack
🇫🇮
Ba-Yu
2026-02-24 12:08:46
UTC ·
(8 months ago)
General hacking/exploits/scanning
Port Scan
Exploited Host
Web App Attack
🇺🇸
S.O.B.A. Dev.
2026-02-24 12:03:32
UTC ·
(8 months ago)
Threat Blocked by BeeHive from (ASN:396982) (Network:GOOGLE-CLOUD-PLATFORM - Google LLC) (Host:soba.dev) (Method:GET) (Protocol:HTTP/1.1) (Timestamp:2026-02-24T12:03:32Z)
Brute-Force
Web Spam
Web App Attack
🇩🇪
big-cloud.nl
2026-02-24 12:01:38
UTC ·
(8 months ago)
Try to access /xmlrpc.php?rsd
Web App Attack
🇧🇪
cmbplf
2026-02-24 11:58:49
UTC ·
(8 months ago)
24.552 post requests in 1 hour (5d11h50m)
Brute-Force
Bad Web Bot
🇫🇮
as211431.net
2026-02-24 11:54:21
UTC ·
(8 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: //site/wp-includes/wlwmanifest.xml
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904. ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: //site/wp-includes/wlwmanifest.xml
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
Blexyel
2026-02-24 11:42:37
UTC ·
(8 months ago)
34.31.161.72 - - [24/Feb/2026:11:42:33 +0000] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
...
Brute-Force
Web App Attack