🇳🇱
thedreamer.nl
2026-10-29 08:53:00
UTC ·
(2 weeks ago)
34.41.198.4 - - [29/Oct/2026:09:50:08 +0100] "GET //wp-includes/ID3/license.txt HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "US" "Council Bluffs" "41.25910 ...
show more
34.41.198.4 - - [29/Oct/2026:09:50:08 +0100] "GET //wp-includes/ID3/license.txt HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "US" "Council Bluffs" "41.25910" "-95.85170"
34.41.198.4 - - [29/Oct/2026:09:50:08 +0100] "GET //feed/ HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "US" "Council Bluffs" "41.25910" "-95.85170"
34.41.198.4 - - [29/Oct/2026:09:50:09 +0100] "GET //xmlrpc.php?rsd HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "US" "Council Bluffs" "41.25910" "-95.85170"
34.41.198.4 - - [29/Oct/2026:09:50:09 +0100] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "US" "Council Bluff
...
show less
Brute-Force
Bad Web Bot
Anonymous
2026-10-29 08:43:35
UTC ·
(2 weeks ago)
[redacted] 34.41.198.4 - - [29/Oct/2026:09:43:25 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.41.198.4 - - [29/Oct/ ...
show more
[redacted] 34.41.198.4 - - [29/Oct/2026:09:43:25 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.41.198.4 - - [29/Oct/2026:09:43:26 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.41.198.4 - - [29/Oct/2026:09:43:27 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.41.198.4 - - [29/Oct/2026:09:43:28 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.41.198.4 - - [29/Oct/2026:09:43:29 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows N
...
show less
Hacking
Web App Attack
Anonymous
2026-10-29 08:43:05
UTC ·
(2 weeks ago)
Blocked by ModSec and CSF
Port Scan
🇨🇭
Ribeye375
2026-10-29 08:41:10
UTC ·
(2 weeks ago)
HIPS rce-attempt - Block tcp/0:65535
Hacking
Web App Attack
🇵🇱
Budyn
2026-10-29 08:40:00
UTC ·
(2 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cdn.astropot.online | URI: //xmlrpc.php?rsd | UA: Mozilla/5.0 ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cdn.astropot.online | URI: //xmlrpc.php?rsd | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"Accept-Encoding":"gzip, br","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"34.41.198.4","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a520df789977cc3a-ORD","Connection":"Keep-Alive","Accept-Language":"en-US,en;q=0.5","Accept":"tex
show less
Bad Web Bot
Web App Attack
Anonymous
2026-10-29 08:28:07
UTC ·
(2 weeks ago)
[news.tmg.gr] httpd-xmlrpc-post: sites=www.cardioathena2023.gr,www.cardiorenal2023.gr; logs=/var/log/httpd/domains/cardioathena2023.gr.log,/var/log/httpd/domains/cardiorenal2023.gr.log; samples=//xmlrpc.php
Brute-Force
Web App Attack
🇩🇪
LRob
2026-10-29 08:25:46
UTC ·
(2 weeks ago)
WordPress attack-tool calls | method: GET | path: //xmlrpc.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Web App Attack
Hacking
🇮🇹
VHosting
2026-10-29 08:25:04
UTC ·
(2 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇩🇪
BlueWire Hosting
2026-10-29 08:23:18
UTC ·
(2 weeks ago)
Probing websites for vulnerabilities
Web App Attack
SQL Injection
🇳🇱
Savvii
2026-10-29 08:22:28
UTC ·
(2 weeks ago)
10 attempts against mh-misc-ban on ficus
Web App Attack
🇳🇱
e.fierstra
2026-10-29 08:20:49
UTC ·
(2 weeks ago)
excessive HTTP 404 errors
Bad Web Bot
Anonymous
2026-10-29 08:18:53
UTC ·
(2 weeks ago)
Automatically blocked after 7 security events. Observed repeated web application attack probes. Source: Cloudflare security controls.
Hacking
Web App Attack
Anonymous
2026-10-29 08:17:24
UTC ·
(2 weeks ago)
[redacted] 34.41.198.4 - - [29/Oct/2026:09:17:14 +0100] "POST //xmlrpc.php HTTP/1.1" 200 401 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.41.198.4 - - [29/Oct/ ...
show more
[redacted] 34.41.198.4 - - [29/Oct/2026:09:17:14 +0100] "POST //xmlrpc.php HTTP/1.1" 200 401 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.41.198.4 - - [29/Oct/2026:09:17:15 +0100] "POST //xmlrpc.php HTTP/1.1" 200 401 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.41.198.4 - - [29/Oct/2026:09:17:16 +0100] "POST //xmlrpc.php HTTP/1.1" 200 401 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.41.198.4 - - [29/Oct/2026:09:17:17 +0100] "POST //xmlrpc.php HTTP/1.1" 200 401 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
[redacted] 34.41.198.4 - - [29/Oct/2026:09:17:18 +0100] "POST //xmlrpc.php HTTP/1.1" 200 401 "-" "Mozilla
...
show less
Hacking
Web App Attack
🇳🇱
tpjg
2026-10-29 08:16:54
UTC ·
(2 weeks ago)
Automated: 15 requests with error status in 120s window from 34.41.198.4.
Evidence: //cms/wp-includes/wlwmanifest.xml:404,//site/wp-includes/wlwmanifest.xml:404,//test/wp-includes/wlwmanifest.xml:404,//wp1/wp-includes/wlwmanifest.xml:404,//shop/wp-in ...
show more
Automated: 15 requests with error status in 120s window from 34.41.198.4.
Evidence: //cms/wp-includes/wlwmanifest.xml:404,//site/wp-includes/wlwmanifest.xml:404,//test/wp-includes/wlwmanifest.xml:404,//wp1/wp-includes/wlwmanifest.xml:404,//shop/wp-includes/wlwmanifest.xml:404,//2021/wp-includes/wlwmanifest.xml:404,//2019/wp-includes/wlwmanifest.xml:404,//2020/wp-includes/wlwmanifest.xml:404,//wp/wp-includes/wlwmanifest.xml:404,//wordpress/wp-includes/wlwmanifest.xml:404,//web/wp-includes/wlwmanifest.xml:404,//blog/wp-includes/wlwmanifest.xml:404,//xmlrpc.php:404,//feed/:404,//wp-includes/ID3/license.txt:404
show less
Web App Attack