This IP address has been reported a total of
10
times from
9 distinct
sources.
34.78.25.148 was first reported on
October 27th 2026 , and the most recent report was
19 hours ago Germany
with 6
reports;
Netherlands
with 2
reports;
Italy
with 1
report.
The most common categories in these recent reports were:
Web App Attack
8
times;
Brute-Force
3
times;
Hacking
2
times;
Exploited Host
1
time;
SQL Injection
1
time;
Other
3
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇩🇪
VonderWulf
2026-10-27 18:21:42
(19 hours ago)
Observed GET WordPress REST user endpoint via nonstandard double-slash path on TCP/443 at 2026-10-27 ...
show more
Observed GET WordPress REST user endpoint via nonstandard double-slash path on TCP/443 at 2026-10-27T18:12:23+01:00; WAF returned HTTP 403 and Fail2Ban banned this source. Correlated 1 audit transaction(s) to the source address.
show less
Web App Attack
2026-10-27 17:21:10
(20 hours ago)
[redacted] 34.78.25.148 - - [27/Oct/2026:18:21:03 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "M ...
show more
[redacted] 34.78.25.148 - - [27/Oct/2026:18:21:03 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[redacted] 34.78.25.148 - - [27/Oct/2026:18:21:04 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[redacted] 34.78.25.148 - - [27/Oct/2026:18:21:04 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[redacted] 34.78.25.148 - - [27/Oct/2026:18:21:05 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[redacted] 34.78.25.148 - - [27/Oct/2026:18:21:
...
show less
Hacking
Web App Attack
🇩🇪
BlueWire Hosting
2026-10-27 17:19:13
(20 hours ago)
Probing websites for vulnerabilities
Web App Attack
SQL Injection
🇩🇪
FeG Deutschland
2026-10-27 17:08:05
(20 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇷🇴
iulianh
2026-10-27 17:05:52
(20 hours ago)
80,443
Brute-Force
SSH
🇮🇹
VHosting
2026-10-27 17:05:04
(20 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-10-27 17:01:59
(20 hours ago)
WordPress login brute force (wp-login/xmlrpc login attempts)
Brute-Force
Web App Attack
2026-10-27 17:00:46
(20 hours ago)
[redacted] 34.78.25.148 - - [27/Oct/2026:18:00:43 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "M ...
show more
[redacted] 34.78.25.148 - - [27/Oct/2026:18:00:43 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[redacted] 34.78.25.148 - - [27/Oct/2026:18:00:43 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[redacted] 34.78.25.148 - - [27/Oct/2026:18:00:44 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[redacted] 34.78.25.148 - - [27/Oct/2026:18:00:44 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[redacted] 34.78.25.148 - - [27/Oct/2026:18:00:44 +0100] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/
...
show less
Hacking
Web App Attack
🇩🇪
LRob
2026-10-27 16:26:44
(21 hours ago)
Self-declared scanner | method: GET | path: / | ua: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https ...
show more
Self-declared scanner | method: GET | path: / | ua: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com)
show less
Port Scan
Web App Attack
🇳🇱
tr1n
2026-10-27 16:24:50
(21 hours ago)
Triggered Cloudflare WAF (firewallCustom) from BE.
Action: BLOCK | ASN: 396982 (Google LLC) | Protoc ...
show more
Triggered Cloudflare WAF (firewallCustom) from BE.
Action: BLOCK | ASN: 396982 (Google LLC) | Protocol: HTTP/2 (GET) | Endpoint: / | Timestamp: 2026-10-27T16:24:50Z | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com)
show less
Bad Web Bot
Showing 1 to
10
of 10 reports
