🇦🇲
arm osint
2026-10-16 20:08:39
UTC ·
(3 weeks ago)
Automated web vulnerability scanning: 18 HTTP 4xx probes for sensitive paths (/2018/wp-includes/wlwmanifest.xml, /2019/wp-includes/wlwmanifest.xml, /blog/wp-includes/wlwmanifest.xml, /cms/wp-includes/wlwmanifest.xml). Detected by Wazuh HIDS rule 3115 ...
show more
Automated web vulnerability scanning: 18 HTTP 4xx probes for sensitive paths (/2018/wp-includes/wlwmanifest.xml, /2019/wp-includes/wlwmanifest.xml, /blog/wp-includes/wlwmanifest.xml, /cms/wp-includes/wlwmanifest.xml). Detected by Wazuh HIDS rule 31151 on a self-hosted web server.
show less
Web App Attack
Brute-Force
🇧🇪
cmbplf
2026-10-16 19:41:43
UTC ·
(3 weeks ago)
2.307 requests with url.path */wp-includes/wlwmanifest.xml
Brute-Force
Bad Web Bot
🇧🇷
dominioz
2026-10-16 18:29:44
UTC ·
(3 weeks ago)
2026-10-16 18:29:24 GET /wp-includes/wlwmanifest.xml - - 35.202.29.172 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/78.0.3904.108+Safari/537.36 - 404 197
2026-10-16 18:29:24 GET /xmlrpc.php rsd - 35 ...
show more
2026-10-16 18:29:24 GET /wp-includes/wlwmanifest.xml - - 35.202.29.172 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/78.0.3904.108+Safari/537.36 - 404 197
2026-10-16 18:29:24 GET /xmlrpc.php rsd - 35.202.29.172 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/78.0.3904.108+Safari/537.36 - 404 197
2026-10-16 18:29:26 GET /blog/wp-includes/wlwmanifest.xml - - 35.202.29.172 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/78.0.3904.108+Safari/537.36 - 404 197
2026-10-16 18:29:26 GET /web/wp-includes/wlwmanifest.xml - - 35.202.29.172 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/78.0.3904.108+Safari/537.36 - 404 197
2026-10-16 18:29:26 GET /wordpress/wp-includes/wlwmanifest.xml - - 35.202.29.172 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/78.0
...
show less
Bad Web Bot
Web App Attack
🇺🇸
WizardsToolkit
2026-10-16 18:14:17
UTC ·
(3 weeks ago)
tried to access forbidden files; attempted to access /wp-includes/wlwmanifest.xml
Web App Attack
🇳🇱
thedreamer.nl
2026-10-16 18:10:36
UTC ·
(3 weeks ago)
35.202.29.172 - - [16/Oct/2026:20:08:01 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" "US" "Council Bluffs" "41.25 ...
show more
35.202.29.172 - - [16/Oct/2026:20:08:01 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" "US" "Council Bluffs" "41.25910" "-95.85170"
35.202.29.172 - - [16/Oct/2026:20:08:02 +0200] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" "US" "Council Bluffs" "41.25910" "-95.85170"
35.202.29.172 - - [16/Oct/2026:20:08:02 +0200] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" "US" "Council Bluffs" "41.25910" "-95.85170"
35.202.29.172 - - [16/Oct/2026:20:08:02 +0200] "GET //wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G
...
show less
Hacking
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
iulianh
2026-10-16 18:02:56
UTC ·
(3 weeks ago)
80,443
Brute-Force
SSH
🇵🇱
Budyn
2026-10-16 17:57:05
UTC ·
(3 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: minio.definitelynotahoneypot.xyz | URI: //xmlrpc.php | UA: Mo ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: minio.definitelynotahoneypot.xyz | URI: //xmlrpc.php | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 | BODY: <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName><params><param><value><array><data> <value><struct><member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member><member><name>params</name><value><array><data><value><array><data><value><string>admin</string><
show less
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-10-16 17:55:03
UTC ·
(3 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇫🇷
ELYAZ
2026-10-16 17:53:33
UTC ·
(3 weeks ago)
(y3) Failed access -byebye- from 35.202.29.172 (US/United States/172.29.202.35.bc.googleusercontent.com): (CF_ENABLE)
Hacking
2026-10-16 17:52:01
UTC ·
(3 weeks ago)
(wordpress) Failed wordpress login from 35.202.29.172 (US/United States/172.29.202.35.bc.googleusercontent.com)
Brute-Force
🇫🇮
as211431.net
2026-10-16 17:39:54
UTC ·
(3 weeks ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 (GET method)
Endpoint: /
UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com)
This report was generated by:
https://github.com/sefinek ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 (GET method)
Endpoint: /
UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
