🇧🇷
ICS Labs
2026-11-04 14:35:19
UTC ·
(5 days ago)
ICS Labs threat intelligence (ICS Feeds): Exploited Host. Last observed 2026-11-04 UTC.
Exploited Host
🇺🇸
kuroneko_omu
2026-11-02 16:51:02
UTC ·
(1 week ago)
[autoreport] Probably Web App attack (eg. wp, phpmyadmin, ...)
Hacking
Brute-Force
Web App Attack
🇮🇹
mgarofano80
2026-11-02 15:14:34
UTC ·
(1 week ago)
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-11-02 11:36:59
UTC ·
(1 week ago)
4.503 requests with url.path */wp-includes/wlwmanifest.xml
Brute-Force
Bad Web Bot
🇩🇪
ghostwarriors
2026-11-02 11:20:17
UTC ·
(1 week ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇳🇿
Tripwire
2026-11-02 11:15:38
UTC ·
(1 week ago)
Scanning for exploits - //wp-includes/wlwmanifest.xml
Web App Attack
🇳🇱
thedreamer.nl
2026-11-02 11:14:35
UTC ·
(1 week ago)
34.69.113.147 - - [02/Nov/2026:12:11:37 +0100] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" "US" "Council Bluffs" "41.25 ...
show more
34.69.113.147 - - [02/Nov/2026:12:11:37 +0100] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" "US" "Council Bluffs" "41.25910" "-95.85170"
34.69.113.147 - - [02/Nov/2026:12:11:38 +0100] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" "US" "Council Bluffs" "41.25910" "-95.85170"
34.69.113.147 - - [02/Nov/2026:12:11:38 +0100] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" "US" "Council Bluffs" "41.25910" "-95.85170"
34.69.113.147 - - [02/Nov/2026:12:11:38 +0100] "GET //wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G
...
show less
Hacking
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
CoreTech srl
2026-11-02 11:09:02
UTC ·
(1 week ago)
cloudlinux2 fail2ban: 2026-11-02 12:03:53,584 fail2ban.actions [1898]: NOTICE [plesk-wordpress] Unban 134.199.166.64cloudlinux2 fail2ban: 2026-11-02 12:04:00,291 fail2ban.actions [1898]: NOTICE [plesk-modsecurity] Unban 34.91.25.41clo ...
show more
cloudlinux2 fail2ban: 2026-11-02 12:03:53,584 fail2ban.actions [1898]: NOTICE [plesk-wordpress] Unban 134.199.166.64cloudlinux2 fail2ban: 2026-11-02 12:04:00,291 fail2ban.actions [1898]: NOTICE [plesk-modsecurity] Unban 34.91.25.41cloudlinux2 fail2ban: 2026-11-02 12:06:27,503 fail2ban.filter [1898]: INFO [plesk-wordpress] Found 14.247.125.98 - 2026-11-02 12:06:26cloudlinux2 fail2ban: 2026-11-02 12:06:28,535 fail2ban.filter [1898]: INFO [plesk-wordpress] Found 186.94.116.43 - 2026-11-02 12:06:28cloudlinux2 fail2ban: 2026-11-02 12:06:44,154 fail2ban.filter [1898]: INFO [plesk-modsecurity] Found 34.69.113.147 - 2026-11-02 12:06:44cloudlinux2 fail2ban: 2026-11-02 12:06:53,092 fail2ban.actions [1898]: NOTICE [plesk-modsecurity] Unban 34.156.49.146cloudlinux2 fail2ban: 2026-11-02 12:07:12,345 fail2ban.filter [1898]: INFO [plesk-wordpress] Found 46.53.224.192 - 2026-11-02 12:07:10cloudlinux2 fail2ban: 2026-11-02 12:07:37,290 fail2ban.filter
show less
Web App Attack
🇩🇪
thesimonmanuel
2026-11-02 11:03:54
UTC ·
(1 week ago)
34.69.113.147 - - [02/Nov/2026:16:33:53 +0530] "GET //blog/wp-includes/wlwmanifest.xml HTTP/2.0" 404 132 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" "34.69.113.147"
Web App Attack
🇩🇪
throny
2026-11-02 11:02:45
UTC ·
(1 week ago)
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 2 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0. ...
show more
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 2 on 1 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.11
Requested, e.g.:
- cdn.[REDACTED]/
- cdn.[REDACTED]/xmlrpc.php?rsd
show less
Web App Attack
🇵🇱
Budyn
2026-11-02 11:02:06
UTC ·
(1 week ago)
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: cdn.budyn.xyz | Path: //xmlrpc.php?rsd | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK ...
show more
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: cdn.budyn.xyz | Path: //xmlrpc.php?rsd | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-11-02 10:59:00
UTC ·
(1 week ago)
Try to access /xmlrpc.php?rsd
Web App Attack
Anonymous
2026-11-02 10:58:03
UTC ·
(1 week ago)
Bot / scanning and/or hacking attempts: POST //xmlrpc.php HTTP/1.1, GET //?author=2 HTTP/1.1
Hacking
Web App Attack
🇺🇸
kuroneko_omu
2026-11-02 10:57:27
UTC ·
(1 week ago)
Fail2Ban <webattack> jail detected 5 attempts against 34.69.113.147.
DDoS Attack
Hacking
Brute-Force
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-11-02 10:54:01
UTC ·
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking