🇩🇪
macrob
2026-11-12 16:15:54
UTC ·
(4 hours ago)
2026/11/12 16:15:53 [error] 2031559#2031559: *32049919 access forbidden by rule, client: 85.211.196.34, server: binixo.co.za, request: "GET //wp-includes/ID3/license.txt HTTP/2.0", host: "binixo.co.za"
2026/11/12 16:15:53 [error] 2031556#2031556: *32 ...
show more
2026/11/12 16:15:53 [error] 2031559#2031559: *32049919 access forbidden by rule, client: 85.211.196.34, server: binixo.co.za, request: "GET //wp-includes/ID3/license.txt HTTP/2.0", host: "binixo.co.za"
2026/11/12 16:15:53 [error] 2031556#2031556: *32083173 access forbidden by rule, client: 85.211.196.34, server: binixo.co.za, request: "GET //xmlrpc.php?rsd HTTP/2.0", host: "binixo.co.za"
2026/11/12 16:15:53 [error] 2031561#2031561: *32111308 access forbidden by rule, client: 85.211.196.34, server: binixo.co.za, request: "GET //blog/wp-includes/wlwmanifest.xml HTTP/2.0", host: "binixo.co.za"
...
show less
Web App Attack
2026-11-12 15:43:51
UTC ·
(5 hours ago)
(wordpress) Failed wordpress login from 85.211.196.34 (MY/Malaysia/Kuala Lumpur/Kuala Lumpur/-/[redacted])
Brute-Force
🇬🇧
BRHosting
2026-11-12 15:38:02
UTC ·
(5 hours ago)
Wordpress brute force attack for login credentials (eg xmlrc.php or wp-login.php)
Brute-Force
Web App Attack
🇩🇪
Vegascosmetics
2026-11-12 12:10:02
UTC ·
(9 hours ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possible exploited host). Evidence: AttackPattern: /wp-includes/ (Match: /wp-includes/)
Hacking
Exploited Host
Web App Attack
2026-11-12 07:22:03
UTC ·
(13 hours ago)
Pay by Jag firewall blocked WordPress probes from this address against protected websites.
Bad Web Bot
Web App Attack
🇧🇷
OliverTRGD
2026-11-12 06:45:43
UTC ·
(14 hours ago)
Web attack detected and blocked: vulnerability scanning. Reported automatically by ForjaIA Immune System.
Web App Attack
🇺🇸
Agaman
2026-11-12 06:44:59
UTC ·
(14 hours ago)
Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-12 06:44 UTC. Samples: GET /wp-includes/id3/license.txt/xmlrpc.php 444; GET /wp-includes/id3/license.txt/blog/wp-includes/wlwmanifest.xml 444. UA: Mozilla/5.0 (Windows NT 10 ...
show more
Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-12 06:44 UTC. Samples: GET /wp-includes/id3/license.txt/xmlrpc.php 444; GET /wp-includes/id3/license.txt/blog/wp-includes/wlwmanifest.xml 444. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban.
show less
Web App Attack
2026-11-11 15:11:41
UTC ·
(1 day ago)
Automatically blocked after 12 security events. Observed repeated web application attack probes. Source: Cloudflare security controls.
Hacking
Web App Attack
2026-11-11 15:04:18
UTC ·
(1 day ago)
2026-11-11T10:04:17.985870-05:00 instance-20260804-1025 wordpress(netal.co)[358224]: Blocked user enumeration attempt from 85.211.196.34
...
Web App Attack
🇫🇷
dynamix
2026-11-11 14:55:54
UTC ·
(1 day ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇨🇦
Dolphi
2026-11-11 14:40:03
UTC ·
(1 day ago)
POST //xmlrpc.php
Brute-Force
Web App Attack
🇩🇪
maxpower
2026-11-11 13:41:41
UTC ·
(1 day ago)
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 85.211.196.34 (MY/Malaysia/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 85.211.196.34 - - [11/Nov/2026:14:41:34 +0100] "GET /xmlrpc.php?rsd HTTP/1.1" 4 ...
show more
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 85.211.196.34 (MY/Malaysia/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 85.211.196.34 - - [11/Nov/2026:14:41:34 +0100] "GET /xmlrpc.php?rsd HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "85.211.196.34" host=abruzzotour.it
2026/11/11 14:41:37 [error] 3289762#3289762: *2896544 access forbidden by rule, client: 85.211.196.34, server: abruzzotour.it.pegasoadv.it, request: "GET /blog//?author=1 HTTP/1.1", host: "abruzzotour.it"
2026/11/11 14:41:38 [error] 3289762#3289762: *2896544 access forbidden by rule, client: 85.211.196.34, server: abruzzotour.it.pegasoadv.it, request: "POST /blog//xmlrpc.php HTTP/1.1", host: "abruzzotour.it"
show less
Port Scan
🇺🇸
IndigoRidge
2026-11-11 13:35:58
UTC ·
(1 day ago)
85.211.196.34 - - [11/Nov/2026:08:35:54 -0500] "GET //xmlrpc.php?rsd HTTP/1.1" 200 5496 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
85.211.196.34 - - [11/Nov/2026:08:35:55 - ...
show more
85.211.196.34 - - [11/Nov/2026:08:35:54 -0500] "GET //xmlrpc.php?rsd HTTP/1.1" 200 5496 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
85.211.196.34 - - [11/Nov/2026:08:35:55 -0500] "GET //?author=1 HTTP/1.1" 301 4750 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
85.211.196.34 - - [11/Nov/2026:08:35:55 -0500] "GET //?author=2 HTTP/1.1" 301 4753 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
85.211.196.34 - - [11/Nov/2026:08:35:56 -0500] "GET //?author=3 HTTP/1.1" 301 4855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"
85.211.196.34 - - [11/Nov/2026:08:35:56 -0500] "GET //wp-json/wp/v2/users/ HTTP/1.1" 200 6637 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
...
show less
Web App Attack
🇳🇱
ismailk
2026-11-11 13:14:02
UTC ·
(1 day ago)
WordPress attack on tuncayozkan.com (auto-detected): tur=imza ulke=MY puan=54 nginx=0 wf=0 cf=23 hiz=2 404cesit=0 gizliyol=0. Blocked by adaptive firewall.
Web App Attack
Bad Web Bot
🇧🇪
madeit
2026-11-11 13:13:15
UTC ·
(1 day ago)
Web App Attack
