🇫🇷
SpaceHost-Server
2026-05-27 22:29:58
(4 months ago)
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-27 21:59:43
(4 months ago)
Auto-ban: 235 malicious requests on 2026-05-26 (e.g., env/backup probes, brute-force, or error burst ...
show more
Auto-ban: 235 malicious requests on 2026-05-26 (e.g., env/backup probes, brute-force, or error bursts).
show less
Web App Attack
SSH
Hacking
🇫🇷
SpaceHost-Server
2026-05-26 22:28:37
(4 months ago)
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-05-26 13:04:18
(4 months ago)
328.843 requests in 3 hours (2mos2w15h)
Brute-Force
Bad Web Bot
🇺🇸
earnquest
2026-05-26 12:09:17
(4 months ago)
Vulnerability scanning detected on EarnQuest Server | Trigger path: //wordpress/wp-includes/wlwmanif ...
show more
Vulnerability scanning detected on EarnQuest Server | Trigger path: //wordpress/wp-includes/wlwmanifest.xml | Total attempts: 5 | Sample paths: //wp-includes/id3/license.txt, //blog/wp-includes/wlwmanifest.xml, //web/wp-includes/wlwmanifest.xml, //wordpress/wp-includes/wlwmanifest.xml | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69... | Blocked by automated scanner detection middleware
show less
Port Scan
🇺🇸
mnsf
2026-05-26 12:05:26
(4 months ago)
Too many Status 40X (12)
Brute-Force
Web App Attack
🇨🇦
Anytech
2026-05-26 11:56:14
(4 months ago)
Blocked by Conn-Monitor: Web scanning activity
Web App Attack
🇩🇪
macrob
2026-05-26 11:55:07
(4 months ago)
2026/05/26 11:55:05 [error] 3724541#3724541: *257814864 access forbidden by rule, client: 35.227.32. ...
show more
2026/05/26 11:55:05 [error] 3724541#3724541: *257814864 access forbidden by rule, client: 35.227.32.6, server: antzfund.com, request: "GET /wp-includes/ID3/license.txt HTTP/1.1", host: "antzfund.com"
2026/05/26 11:55:06 [error] 3724541#3724541: *257814879 access forbidden by rule, client: 35.227.32.6, server: antzfund.com, request: "GET /xmlrpc.php?rsd HTTP/1.1", host: "antzfund.com"
2026/05/26 11:55:06 [error] 3724541#3724541: *257814881 access forbidden by rule, client: 35.227.32.6, server: antzfund.com, request: "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1", host: "antzfund.com"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-26 11:54:58
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 35.227.32.6 (6.32.227.35.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:225170) triggered by 35.227.32.6 (6.32.227.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 07:54:52.520598 2026] [security2:error] [pid 18599:tid 18599] [client 35.227.32.6:61962] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||answeringilliana.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "answeringilliana.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ahWKDC3nsw497fBXU216KAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇿
Antinson
2026-05-26 11:50:44
(4 months ago)
Scraping with a high error ratio and request rate
Bad Web Bot
🇩🇪
pltcldvlpr
2026-05-26 11:42:04
(4 months ago)
CMS/framework probe: 35.227.32.6 - - [26/May/2026:13:42:04 +0200] "GET //wp-includes/ID3/license.txt ...
show more
CMS/framework probe: 35.227.32.6 - - [26/May/2026:13:42:04 +0200] "GET //wp-includes/ID3/license.txt HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" asn=396982 org="Google LLC" country=US
...
show less
Web App Attack
🇩🇪
Ano_Nym
2026-05-26 11:41:55
(4 months ago)
CrowdSec IDS alert on VPS 217.154.115.19 (DE). Scenario: crowdsecurity/http-probing
Web App Attack
🇺🇸
alecj.com
2026-05-26 11:41:48
(4 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇨🇭
zynex
2026-05-26 11:40:13
(4 months ago)
URL Probing: /wordpress/wp-includes/wlwmanifest.xml
Web App Attack
🇺🇸
TPI-Abuse
2026-05-26 11:36:12
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 35.227.32.6 (6.32.227.35.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:225170) triggered by 35.227.32.6 (6.32.227.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 07:36:09.276335 2026] [security2:error] [pid 31830:tid 31830] [client 35.227.32.6:49883] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.americanacademyofteachersofsinging.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.americanacademyofteachersofsinging.org"] [uri "/wp-json/wp/v2/users/"] [unique_id "ahWFqeSdMY-oYv6znMdEDQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack