🇧🇷
radardatelecom
2026-10-28 16:52:04
UTC ·
(2 weeks ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇧🇪
Ivo Vynckier
2026-10-28 15:29:00
UTC ·
(2 weeks ago)
35.255.81.11 - - [28/Oct/2026:12:06:12 +0100] "GET //wp-includes/ID3/license.txt HTTP/1.1" 404 7295 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
35.255.81.11 - - [28/Oct/202 ...
show more
35.255.81.11 - - [28/Oct/2026:12:06:12 +0100] "GET //wp-includes/ID3/license.txt HTTP/1.1" 404 7295 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
35.255.81.11 - - [28/Oct/2026:12:06:12 +0100] "GET //feed/ HTTP/1.1" 403 822 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
35.255.81.11 - - [28/Oct/2026:12:06:12 +0100] "GET //xmlrpc.php?rsd HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
show less
Web App Attack
🇺🇸
mnsf
2026-10-28 12:05:11
UTC ·
(2 weeks ago)
Too many Status 40X (14)
Brute-Force
Web App Attack
🇬🇧
AvonleaConsulting
2026-10-28 11:48:05
UTC ·
(2 weeks ago)
Scanning unused Default website or suspicious access to valid sites from IP marked as abusive
Bad Web Bot
Web App Attack
🇳🇱
sembeek
2026-10-28 11:40:58
UTC ·
(2 weeks ago)
probing for exposed files and admin pages: 11 attempts within 1 minute, seen by CrowdSec (reported by RemotePower)
Web App Attack
2026-10-28 11:40:18
UTC ·
(2 weeks ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇨🇭
backslash
2026-10-28 11:36:00
UTC ·
(2 weeks ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇩🇪
big-cloud.nl
2026-10-28 11:35:28
UTC ·
(2 weeks ago)
Try to access /xmlrpc.php?rsd
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-28 11:34:31
UTC ·
(2 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇫🇮
KTSTechnology
2026-10-28 11:32:49
UTC ·
(2 weeks ago)
Web vulnerability scanning detected by our ISP firewall
Web App Attack
🇵🇱
Budyn
2026-10-28 11:29:00
UTC ·
(2 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: status.definitelynotahoneypot.xyz | URI: //xmlrpc.php?rsd | U ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: status.definitelynotahoneypot.xyz | URI: //xmlrpc.php?rsd | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"Accept-Encoding":"gzip, br","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"35.255.81.11","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a51999ab1e75dc1f-ORD","Connection":"Keep-Alive","Accept-Language":"en-US,en;q=0.5
show less
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-10-28 11:28:51
UTC ·
(2 weeks ago)
{"level":"info","ts":1793186921.2168074,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.255.81.11","remote_port":"54326","client_ip":"35.255.81.11","proto":"HTTP/1.1","method":"GET","host":"status3.championwindows.b ...
show more
{"level":"info","ts":1793186921.2168074,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.255.81.11","remote_port":"54326","client_ip":"35.255.81.11","proto":"HTTP/1.1","method":"GET","host":"status3.championwindows.biz","uri":"/","headers":{"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"Keep-Alive":["300"],"Connection":["keep-alive"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"],"Accept-Language":["en-US,en;q=0.5"]}},"bytes_read":0,"user_id":"","duration":0.000060666,"size":0,"status":308,"resp_headers":{"Content-Type":[],"Server":["Caddy"],"Connection":["close"],"Location":["https://status3.championwindows.biz/"]}}
{"level":"info","ts":1793186921.4739103,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.255.81.11","remote_port":"61356","client_ip":"35.255.81.11","proto":"HTTP/1.1","method":"GET","host":"
...
show less
DDoS Attack
Web App Attack
🇫🇷
Safronus
2026-10-28 11:28:15
UTC ·
(2 weeks ago)
Banned by fail2ban jail=nginx-noscript match=$f2bV_matches
Bad Web Bot
Web App Attack
🇯🇵
weils.net
2026-10-28 11:27:52
UTC ·
(2 weeks ago)
2026-10-28 19:27:51(GMT+8) - /cms/wp-includes/wlwmanifest.xml
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-28 11:24:52
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 35.255.81.11 (11.81.255.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 07:24:45.316969 2026] [security2:error] [pid 19123:tid 19 ...
show more
(mod_security) mod_security (id:225170) triggered by 35.255.81.11 (11.81.255.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 07:24:45.316969 2026] [security2:error] [pid 19123:tid 19123] [client 35.255.81.11:57537] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||stantontownshipmn.gov.stantontownship.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "stantontownshipmn.gov.stantontownship.org"] [uri "/wp-json/wp/v2/users/"] [unique_id "auHbfRvcdPYaH0w4CAtt3gAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
