|
🇹🇷
neron
|
|
CrowdSec blocked: http:scan detected via OPNsense firewall
|
Hacking
Web App Attack
|
|
Anonymous
|
|
WordPress login / xmlrpc probing across multiple sites
|
Web App Attack
|
|
🇫🇷
Vaction
|
|
45.146.54.98 - - [14/Oct/2026:06:11:33 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 404 400 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"
|
Hacking
Bad Web Bot
Web App Attack
|
|
🇫🇷
Kejult
|
|
Honeypot Finding: verified TCP multi-port scan/probing; 6 application-level events across 2 target ports and 3 source port(s). Ports: 80/HTTP, 443/HTTPS. Sensors: H0neytr4p, Tanner.
|
Port Scan
|
|
🇪🇸
librebit
|
|
Brute force
|
Brute-Force
|
|
Anonymous
|
|
Attack detected: 45.146.54.98 [2026-09-12]
Categories: 21
--- wp2shell/batch exploit (2 hits) ---
45.146.54.98 - - [29/Jul/2026:19:26:09 +0000] "POST //wp-json/batch/v1 HTTP/1.1" 207 1208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML ...
show more
Attack detected: 45.146.54.98 [2026-09-12]
Categories: 21
--- wp2shell/batch exploit (2 hits) ---
45.146.54.98 - - [29/Jul/2026:19:26:09 +0000] "POST //wp-json/batch/v1 HTTP/1.1" 207 1208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
45.146.54.98 - - [29/Jul/2026:19:26:11 +0000] "POST //?rest_route=/batch/v1 HTTP/1.1" 207 1208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
show less
|
Web App Attack
|
|
Anonymous
|
|
Attack detected: 45.146.54.98 [2026-08-28]
Categories: 21
--- wp2shell/batch exploit (2 hits) ---
45.146.54.98 - - [29/Jul/2026:19:26:09 +0000] "POST //wp-json/batch/v1 HTTP/1.1" 207 1208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML ...
show more
Attack detected: 45.146.54.98 [2026-08-28]
Categories: 21
--- wp2shell/batch exploit (2 hits) ---
45.146.54.98 - - [29/Jul/2026:19:26:09 +0000] "POST //wp-json/batch/v1 HTTP/1.1" 207 1208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
45.146.54.98 - - [29/Jul/2026:19:26:11 +0000] "POST //?rest_route=/batch/v1 HTTP/1.1" 207 1208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
show less
|
Web App Attack
|
|
Anonymous
|
|
Attack detected: 45.146.54.98 [2026-08-13]
Categories: 21
--- wp2shell/batch exploit (2 hits) ---
45.146.54.98 - - [29/Jul/2026:19:26:09 +0000] "POST //wp-json/batch/v1 HTTP/1.1" 207 1208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML ...
show more
Attack detected: 45.146.54.98 [2026-08-13]
Categories: 21
--- wp2shell/batch exploit (2 hits) ---
45.146.54.98 - - [29/Jul/2026:19:26:09 +0000] "POST //wp-json/batch/v1 HTTP/1.1" 207 1208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
45.146.54.98 - - [29/Jul/2026:19:26:11 +0000] "POST //?rest_route=/batch/v1 HTTP/1.1" 207 1208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
show less
|
Web App Attack
|
|
🇺🇸
koinkash.org
|
|
They are fraudulent. Malicious threat actor requesting php file /wp-login.php
|
Web App Attack
|
|
🇺🇸
kosada.com
|
|
Web vulnerability probing: /wp-includes/assets/
|
Web App Attack
|
|
🇺🇸
ph
|
|
Bad web bot attempting to run wp-content on non-WP site
|
Hacking
Bad Web Bot
Web App Attack
|
|
🇮🇹
CoreTech srl
|
|
cloudlinux2 fail2ban: 2026-08-01 13:14:14,333 fail2ban.filter [1838]: INFO [plesk-modsecurity] Found 58.136.115.99 - 2026-08-01 13:14:14cloudlinux2 fail2ban: 2026-08-01 13:14:28,890 fail2ban.filter [1838]: INFO [plesk-wordpress] ...
show more
cloudlinux2 fail2ban: 2026-08-01 13:14:14,333 fail2ban.filter [1838]: INFO [plesk-modsecurity] Found 58.136.115.99 - 2026-08-01 13:14:14cloudlinux2 fail2ban: 2026-08-01 13:14:28,890 fail2ban.filter [1838]: INFO [plesk-wordpress] Found 23.94.155.109 - 2026-08-01 13:14:26cloudlinux2 fail2ban: 2026-08-01 13:14:28,890 fail2ban.filter [1838]: INFO [plesk-wordpress] Found 23.94.155.115 - 2026-08-01 13:14:26cloudlinux2 fail2ban: 2026-08-01 13:14:57,130 fail2ban.actions [1838]: NOTICE [plesk-modsecurity] Ban 58.136.115.99cloudlinux2 fail2ban: 2026-08-01 13:14:56,698 fail2ban.filter [1838]: INFO [plesk-modsecurity] Found 58.136.115.99 - 2026-08-01 13:14:56cloudlinux2 fail2ban: 2026-08-01 13:14:57,228 fail2ban.filter [1838]: INFO [recidive] Found 58.136.115.99 - 2026-08-01 13:14:57cloudlinux2 fail2ban: 2026-08-01 13:16:00,296 fail2ban.filter [1838]: INFO [plesk-modsecurity] Found 113.203.196.88 - 2026-08-01 13:16:00cloudlinux2 fail2ban: 2026-08-0
show less
|
Web App Attack
|
|
Anonymous
|
|
Attack detected: 45.146.54.98 [2026-07-29]
Categories: 21
--- wp2shell/batch exploit (2 hits) ---
45.146.54.98 - - [29/Jul/2026:19:26:09 +0000] "POST //wp-json/batch/v1 HTTP/1.1" 207 1208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML ...
show more
Attack detected: 45.146.54.98 [2026-07-29]
Categories: 21
--- wp2shell/batch exploit (2 hits) ---
45.146.54.98 - - [29/Jul/2026:19:26:09 +0000] "POST //wp-json/batch/v1 HTTP/1.1" 207 1208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
45.146.54.98 - - [29/Jul/2026:19:26:11 +0000] "POST //?rest_route=/batch/v1 HTTP/1.1" 207 1208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
show less
|
Web App Attack
|
|
🇩🇪
LRob
|
|
CrowdSec: crowdsecurity/http-cve-probing | req: //wp-json/batch/v1 | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
|
Web App Attack
|
|
🇪🇸
alferez
|
|
wp2shell bug exploit
|
Hacking
Exploited Host
Web App Attack
|