🇧🇪
cmbplf
2026-01-20 18:04:52
UTC ·
(9 months ago)
36.414 requests in 1 hour (3mos1w3d)
Brute-Force
Bad Web Bot
Anonymous
2026-01-20 17:53:15
UTC ·
(9 months ago)
wordpress exploit scan
Web App Attack
🇩🇪
Viveronese
2026-01-20 17:48:40
UTC ·
(9 months ago)
HTTP vulnerability scanning
Web App Attack
🇺🇸
Major Hostility
2026-01-20 17:47:13
UTC ·
(9 months ago)
"GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET /xmlrpc.php?rsd HTTP/1.1" 403
"GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET /web/wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET ...
show more
"GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET /xmlrpc.php?rsd HTTP/1.1" 403
"GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET /web/wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET /website/wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET /wp/wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET /news/wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET /2018/wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET /2019/wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET /shop/wp-includes/wlwmanifest.xml HTTP/1.1" 404
"GET /wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404
show less
Web App Attack
🇫🇷
masterguru
2026-01-20 17:25:33
UTC ·
(9 months ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 35.196.10.29 (US/United States/29.10.196.35.bc.googleusercontent.com): 1 in the last 3600 secs (0-195)
Hacking
🇩🇪
BlueWire Hosting
2026-01-20 17:23:50
UTC ·
(9 months ago)
Probing websites for vulnerabilities
SQL Injection
Web App Attack
🇫🇮
as211431.net
2026-01-20 17:20:56
UTC ·
(9 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: //2018/wp-includes/wlwmanifest.xml
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904. ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: //2018/wp-includes/wlwmanifest.xml
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇧🇾
lns.bz
2026-01-20 17:20:16
UTC ·
(9 months ago)
Too many 404 requests [BY]
Web App Attack
🇨🇭
zynex
2026-01-20 17:16:18
UTC ·
(9 months ago)
URL Probing: /2019/wp-includes/wlwmanifest.xml
Web App Attack
🇺🇸
TPI-Abuse
2026-01-20 17:09:16
UTC ·
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 35.196.10.29 (29.10.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 20 12:09:10.938375 2026] [security2:error] [pid 20902:tid 20 ...
show more
(mod_security) mod_security (id:225170) triggered by 35.196.10.29 (29.10.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 20 12:09:10.938375 2026] [security2:error] [pid 20902:tid 20902] [client 35.196.10.29:55762] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.smartradios.info|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.smartradios.info"] [uri "/wp-json/wp/v2/users/"] [unique_id "aW-2tt515FlspWBlLppYqQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
Burayot
2026-01-20 17:07:16
UTC ·
(9 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 35.196.10.29 (US/United States/29.10.196.35.bc.googleusercontent.com): 1 in the last 3600 secs
Web App Attack
🇩🇪
kjaerulff
2026-01-20 17:06:49
UTC ·
(9 months ago)
Failed Wordpress login using xmlrpc.php (29.10.196.35.bc.googleusercontent.com)
Web App Attack
🇩🇪
FeG Deutschland
2026-01-20 17:03:48
UTC ·
(9 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇩🇪
conseilgouz
2026-01-20 16:53:21
UTC ·
(9 months ago)
sle-7 : Trying access unauthorized files/dir=>//wp-includes/wlwmanifest.xml
Hacking
Anonymous
2026-01-20 16:52:24
UTC ·
(9 months ago)
[redacted] 35.196.10.29 - - [20/Jan/2026:17:52:03 +0100] "POST //xmlrpc.php HTTP/1.1" 200 460 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[redacted] 35.196.10.29 - - [20/J ...
show more
[redacted] 35.196.10.29 - - [20/Jan/2026:17:52:03 +0100] "POST //xmlrpc.php HTTP/1.1" 200 460 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[redacted] 35.196.10.29 - - [20/Jan/2026:17:52:06 +0100] "POST //xmlrpc.php HTTP/1.1" 200 460 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[redacted] 35.196.10.29 - - [20/Jan/2026:17:52:08 +0100] "POST //xmlrpc.php HTTP/1.1" 200 460 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[redacted] 35.196.10.29 - - [20/Jan/2026:17:52:10 +0100] "POST //xmlrpc.php HTTP/1.1" 200 460 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[redacted] 35.196.10.29 - - [20/Jan/2026:17:52:12 +0100] "POST //xmlrpc.php HTTP/1.1" 200 460 "-" "Mozilla/5.0 (Windows NT 10.0
...
show less
Hacking
Web App Attack