Anonymous
2026-07-21 10:07:02
(18 hours ago)
Automated web scanner. Requested suspicious paths: //xmlrpc.php | //wp-includes/ID3/license.txt | // ...
show more
Automated web scanner. Requested suspicious paths: //xmlrpc.php | //wp-includes/ID3/license.txt | //web/wp-includes/wlwmanifest.xml | //2020/wp-includes/wlwmanifest.xml | //blog/wp-includes/wlwmanifest.xml | //2019/wp-includes/wlwmanifest.xml | //wp/wp-includes/wlwmanifest.xml | //2021/wp-includes/wlwmanifest.xml | //wordpress/wp-includes/wlwmanifest.xml | //test/wp-includes/wlwmanifest.xml | //shop/wp-includes/wlwmanifest.xml | //site/wp-includes/wlwmanifest.xml | //wp1/wp-includes/wlwmanifest.xml | //cms/wp-includes/wlwmanifest.xml | //wp-incl. UTC: 2026-07-21 09:14:52.
show less
Web App Attack
Anonymous
2026-07-21 09:33:07
(19 hours ago)
Bot / scanning and/or hacking attempts: POST //xmlrpc.php HTTP/1.1
Hacking
Web App Attack
๐ณ๐ฑ
Site.eu
2026-07-21 09:28:19
(19 hours ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
๐ณ๐ฑ
Savvii
2026-07-21 09:28:00
(19 hours ago)
10 attempts against mh-misc-ban on frost
Web App Attack
๐บ๐ธ
Lee Daniel
2026-07-21 09:25:18
(19 hours ago)
34.73.90.205 - - [21/Jul/2026:05:25:14 -0400] "GET //wp/wp-includes/wlwmanifest.xml HTTP/1.1" 404 25 ...
show more
34.73.90.205 - - [21/Jul/2026:05:25:14 -0400] "GET //wp/wp-includes/wlwmanifest.xml HTTP/1.1" 404 25798 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.73.90.205 - - [21/Jul/2026:05:25:15 -0400] "GET //2020/wp-includes/wlwmanifest.xml HTTP/1.1" 404 25806 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.73.90.205 - - [21/Jul/2026:05:25:15 -0400] "GET //2019/wp-includes/wlwmanifest.xml HTTP/1.1" 404 25806 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.73.90.205 - - [21/Jul/2026:05:25:16 -0400] "GET //2021/wp-includes/wlwmanifest.xml HTTP/1.1" 404 25806 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
34.73.90.205 - - [21/Jul/2026:05:25:17 -0400] "GET //shop/wp-includes/wlwmanifest.xml HTTP/1.1
...
show less
DDoS Attack
Web Spam
Email Spam
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
๐ธ๐ช
nekopavel
2026-07-21 09:15:35
(19 hours ago)
34.73.90.205 - - [21/Jul/2026:11:15:33 +0200]"GET /wp-includes/ID3/license.txt HTTP/1.1" 404 123841" ...
show more
34.73.90.205 - - [21/Jul/2026:11:15:33 +0200]"GET /wp-includes/ID3/license.txt HTTP/1.1" 404 123841"-" mishashto.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36""0.005" "0.000""North Charleston" "US"
34.73.90.205 - - [21/Jul/2026:11:15:33 +0200]"GET /xmlrpc.php?rsd HTTP/1.1" 404 123772"-" mishashto.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36""0.130" "0.001""North Charleston" "US"
34.73.90.205 - - [21/Jul/2026:11:15:34 +0200]"GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 123856"-" mishashto.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36""0.268" "0.000""North Charleston" "US"
...
show less
Hacking
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-07-21 09:15:19
(19 hours ago)
(mod_security) mod_security (id:225170) triggered by 34.73.90.205 (205.90.73.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:225170) triggered by 34.73.90.205 (205.90.73.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 05:15:15.166590 2026] [security2:error] [pid 2794189:tid 2794189] [client 34.73.90.205:54602] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||reyadecostarica.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "reyadecostarica.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "al84o5JONxnoE-ArbOyWwQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ณ๐ฟ
Antinson
2026-07-21 09:14:05
(19 hours ago)
Scraping with a high error ratio and request rate
Bad Web Bot
๐บ๐ธ
lostswordfish.com
2026-07-21 09:10:05
(19 hours ago)
Wordfence waf block on registrymatters
Web App Attack
๐ณ๐ฑ
maxxsense
2026-07-21 09:05:53
(19 hours ago)
(wordpress) Failed wordpress login from 34.73.90.205 (US/United States/205.90.73.34.bc.googleusercon ...
show more
(wordpress) Failed wordpress login from 34.73.90.205 (US/United States/205.90.73.34.bc.googleusercontent.com)
show less
Brute-Force
๐ฎ๐น
VHosting
2026-07-21 09:05:03
(19 hours ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
๐ฌ๐ง
pinguin
2026-07-21 09:00:40
(20 hours ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: LOG
Protocol: HTTP/1.1 (GET method ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: LOG
Protocol: HTTP/1.1 (GET method)
Endpoint: //shop/wp-includes/wlwmanifest.xml
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
๐ฉ๐ช
FeG Deutschland
2026-07-21 08:57:58
(20 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 27
Exploited Host
Web App Attack
๐ฏ๐ต
Valhalla
2026-07-21 08:54:59
(20 hours ago)
/wp-includes/ID3/license.txt
Hacking
Web App Attack
๐ซ๐ท
dynamix
2026-07-21 08:54:54
(20 hours ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack