🇨🇭
Origon
2026-08-20 08:29:00
UTC ·
(2 months ago)
http-probing - IP: 35.196.83.192 - time="2026-08-20T10:28:59+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-probing by ip 35.196.83.192 (US/396982) : 4h ban on Ip 35.196.83.192" module=db
Web App Attack
🇸🇪
vaia.cloud
2026-08-20 08:25:04
UTC ·
(2 months ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-20 08:19:15
UTC ·
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 35.196.83.192 (192.83.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 04:19:10.047445 2026] [security2:error] [pid 26498:tid ...
show more
(mod_security) mod_security (id:225170) triggered by 35.196.83.192 (192.83.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 04:19:10.047445 2026] [security2:error] [pid 26498:tid 26535] [client 35.196.83.192:52050] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||nabsci.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nabsci.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aoa4fkTOvadgRr6FI68dBwAAAJE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-08-20 08:17:39
UTC ·
(2 months ago)
Web App Attack
🇺🇸
mnsf
2026-08-20 08:05:19
UTC ·
(2 months ago)
Abuse Detected (9)
Brute-Force
Web App Attack
🇬🇧
Mendip_Defender
2026-08-20 08:04:49
UTC ·
(2 months ago)
35.196.83.192 - - [20/Aug/2026:09:04:55 +0100] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 6355 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
35.196.83.192 - - [20/Aug/2 ...
show more
35.196.83.192 - - [20/Aug/2026:09:04:55 +0100] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 6355 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
35.196.83.192 - - [20/Aug/2026:09:04:56 +0100] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 6355 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
35.196.83.192 - - [20/Aug/2026:09:04:56 +0100] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 6355 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
...
show less
Hacking
Web App Attack
🇺🇸
masterguru
2026-08-20 08:04:45
UTC ·
(2 months ago)
WordPress: User enumeration. Pattern match "(author\\\\= (88030-147)
Hacking
🇵🇱
strefapi_com
2026-08-20 07:55:04
UTC ·
(2 months ago)
Brute-force, web
...
Hacking
Brute-Force
Web App Attack
🇩🇪
ghostwarriors
2026-08-20 07:50:04
UTC ·
(2 months ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇰
ScamAware
2026-08-20 07:49:34
UTC ·
(2 months ago)
Detected by Cloudflare Security Events via WordPress automation. Detection: bad_bot_scanner (Bad bot / scanner behavior). Hits from same IP in last 60 minutes: 1. Unique request paths counted internally: 1. Cloudflare action: block. Cloudflare source ...
show more
Detected by Cloudflare Security Events via WordPress automation. Detection: bad_bot_scanner (Bad bot / scanner behavior). Hits from same IP in last 60 minutes: 1. Unique request paths counted internally: 1. Cloudflare action: block. Cloudflare source: firewallCustom.
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-20 07:42:12
UTC ·
(2 months ago)
(mod_security) mod_security (id:225170) triggered by 35.196.83.192 (192.83.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 03:42:07.307046 2026] [security2:error] [pid 11606:tid ...
show more
(mod_security) mod_security (id:225170) triggered by 35.196.83.192 (192.83.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 03:42:07.307046 2026] [security2:error] [pid 11606:tid 11606] [client 35.196.83.192:63934] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.midwayisland.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.midwayisland.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aoavz66uA0UAz4b-Zqk8tQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
yitzhaq
2026-08-20 07:41:08
UTC ·
(2 months ago)
35.196.83.192 - - [20/Aug/2026:09:41:02 +0200] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 301 645 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
35.196.83.192 - - [20/Au ...
show more
35.196.83.192 - - [20/Aug/2026:09:41:02 +0200] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 301 645 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
35.196.83.192 - - [20/Aug/2026:09:41:02 +0200] "GET //wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 301 657 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
35.196.83.192 - - [20/Aug/2026:09:41:02 +0200] "GET //website/wp-includes/wlwmanifest.xml HTTP/1.1" 301 653 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
35.196.83.192 - - [20/Aug/2026:09:41:02 +0200] "GET //wp/wp-includes/wlwmanifest.xml HTTP/1.1" 301 643 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
35.196.83.192 - - [20/Aug/2026:09:41:02 +0200] "GET //news/wp-includes/wlwmanifest.xml
show less
Bad Web Bot
🇩🇪
big-cloud.nl
2026-08-20 07:40:42
UTC ·
(2 months ago)
Try to access /dorpskrant//xmlrpc.php?rsd
Web App Attack
🇦🇺
Klaverstyn
2026-08-20 07:40:23
UTC ·
(2 months ago)
Repeated 403 Forbidden responses
Web App Attack
🇩🇪
NihiliousMonk
2026-08-20 07:40:12
UTC ·
(2 months ago)
Fail2Ban report from jail npm-scanners
Bad Web Bot
Web App Attack