Automated scanning against WordPress site. The IP sent rapid requests to xmlrpc.php combined with a ...
show moreAutomated scanning against WordPress site. The IP sent rapid requests to xmlrpc.php combined with a large burst of requests that generated multiple 404 Not Found responses (http-404-scan filter). Typical vulnerability reconnaissance and XML-RPC abuse behavior. Banned immediately by Fail2Ban with recidive and recidive_permanent triggers.
show less
Automated scanning against WordPress site. The IP sent rapid requests to xmlrpc.php combined with a ...
show moreAutomated scanning against WordPress site. The IP sent rapid requests to xmlrpc.php combined with a large burst of requests that generated multiple 404 Not Found responses (http-404-scan filter). Typical vulnerability reconnaissance and XML-RPC abuse behavior.
show less
Automated scanning against WordPress site. The IP sent rapid requests to xmlrpc.php and generated a ...
show moreAutomated scanning against WordPress site. The IP sent rapid requests to xmlrpc.php and generated a large burst of 404 Not Found responses (http-404-scan filter). Typical vulnerability reconnaissance and XML-RPC abuse behavior.
show less
Automated scanning against WordPress site. The IP sent a rapid burst of requests resulting in multip ...
show moreAutomated scanning against WordPress site. The IP sent a rapid burst of requests resulting in multiple 404 Not Found responses along with probing of wp-php files and WordPress plugin paths. Typical vulnerability reconnaissance behavior.
show less
Automated scanning against WordPress site. The IP sent rapid requests to /wp-content/plugins/ paths ...
show moreAutomated scanning against WordPress site. The IP sent rapid requests to /wp-content/plugins/ paths combined with a large burst of requests that generated multiple 404 Not Found responses. It also accessed xmlrpc.php. Typical vulnerability reconnaissance behavior.
show less
Automated scanning against WordPress site. The IP sent rapid requests to /wp-content/plugins/ paths ...
show moreAutomated scanning against WordPress site. The IP sent rapid requests to /wp-content/plugins/ paths combined with a large burst of requests that generated multiple 404 Not Found responses . Typical vulnerability reconnaissance behavior.
show less
Automated reconnaissance and probing against WordPress site. The IP accessed sensitive files and dir ...
show moreAutomated reconnaissance and probing against WordPress site. The IP accessed sensitive files and directories while also generating multiple 404 responses . The same IP has shown similar scanning behavior on previous dates.
show less
Automated attack on WordPress site. The IP performed rapid scanning of /wp-content/plugins/ paths re ...
show moreAutomated attack on WordPress site. The IP performed rapid scanning of /wp-content/plugins/ paths resulting in 404 errors, followed by repeated requests to wp-login.php and wp-get activity combined with wp-admin-probe. This indicates systematic vulnerability scanning and brute-force login attempts against the WordPress installation.
show less
Automated attack on WordPress site. The IP sent multiple requests to xmlrpc.php on two separate occa ...
show moreAutomated attack on WordPress site. The IP sent multiple requests to xmlrpc.php on two separate occasions (March 30 and April 1) along with 404 scanning activity. This matches common XML-RPC pingback abuse and brute-force attempts against WordPress installations. It also triggered apache-auth on an earlier date.
show less
Automated attack on WordPress site. The IP sent requests to sensitive files and directories followe ...
show moreAutomated attack on WordPress site. The IP sent requests to sensitive files and directories followed by additional scanning activity that generated 404 responses. Typical reconnaissance and exploitation attempt against web application configuration files.
show less
Persistent automated scanning against WordPress site over multiple days. The IP repeatedly sent burs ...
show morePersistent automated scanning against WordPress site over multiple days. The IP repeatedly sent bursts of requests to /wp-content/plugins/ paths (wordpress-scan) and generated large numbers of 404 Not Found responses (http-404-scan). It also probed wp-admin areas (wp-admin-probe), wp-get, wp-php-probe, and occasionally xmlrpc.php and sensitive files.
show less
Automated attack on WordPress site. The IP 35.192.170.185 sent multiple POST/GET requests to xmlrpc. ...
show moreAutomated attack on WordPress site. The IP 35.192.170.185 sent multiple POST/GET requests to xmlrpc.php in quick succession (02:28:39 and 02:28:47). This is a classic XML-RPC pingback abuse / brute-force vector commonly used to exploit or overload WordPress installations.
show less
Automated WordPress reconnaissance: rapid requests to /wp-content/plugins/* resulting in 404 errors. ...
show moreAutomated WordPress reconnaissance: rapid requests to /wp-content/plugins/* resulting in 404 errors. Triggered wordpress-scan and http-404-scan filters. Banned by Fail2Ban with recidive triggers.
show less
Automated WordPress scanning: hundreds of rapid GET requests detected by wp-get filter + wp-admin pr ...
show moreAutomated WordPress scanning: hundreds of rapid GET requests detected by wp-get filter + wp-admin probing. Banned multiple times by Fail2Ban (wp-get jail) with recidive triggers. Persistent malicious activity over ~1 hour.
show less
Persistent automated scanning against WordPress site. Hundreds of requests to /wp-content/plugins/* ...
show morePersistent automated scanning against WordPress site. Hundreds of requests to /wp-content/plugins/* and other paths resulting in 404 errors. Triggered http-404-scan, wordpress-scan, and wp-admin-probe filters. Repeat offender banned multiple times by Fail2Ban over 3+ days.
show less
The IP was scanning for sensitive files (wp-config.php, .env, .git, backup files).
Detected as mali ...
show moreThe IP was scanning for sensitive files (wp-config.php, .env, .git, backup files).
Detected as malicious activity and blocked.
show less