167.99.40.241

Web attack/malicious scanning detected

Detected WordPress attack from 4 different servers

Triggered Cloudflare WAF (firewallManaged) from NL. Action taken: LOG Protocol: HTTP/1.1 (GET method) Endpoint: /wp-login.php UA: Mozilla/5.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB

Probing for Wordpress - /wp-login.php

167.99.40.241 fell into Endlessh tarpit; 0/1 total connections are currently still open. Total time wasted: 3s. Total bytes sent by tarpit: 309B. Report generated by Endlessh Report Generator v1.2.3

167.99.40.241 fell into Endlessh tarpit; 0/1 total connections are currently still open. Total time wasted: 3s. Total bytes sent by tarpit: 309B. Report generated by Endlessh Report Generator v1.2.3

167.99.40.241 fell into Endlessh tarpit; 0/1 total connections are currently still open. Total time wasted: 3s. Total bytes sent by tarpit: 309B. Report generated by Endlessh Report Generator v1.2.3

167.99.40.241 fell into Endlessh tarpit; 0/1 total connections are currently still open. Total time wasted: 3s. Total bytes sent by tarpit: 309B. Report generated by Endlessh Report Generator v1.2.3

list.rtbh.com.tr report: tcp/0

167.99.40.241 fell into Endlessh tarpit; 0/1 total connections are currently still open. Total time wasted: 3s. Total bytes sent by tarpit: 309B. Report generated by Endlessh Report Generator v1.2.3

list.rtbh.com.tr report: tcp/0

Session Report (UTC: 2025-12-21T07:29:46.644Z) Session Duration: 2025-12-21T07:29:23.630Z - 2025-12-21T07:29:46.644Z Client: SSH-2.0-Go Source Port: 60128 Activities: - no_auth - Login attempt - User: search (SUCCESS) - connection - debug_channel - ... show more Session Report (UTC: 2025-12-21T07:29:46.644Z) Session Duration: 2025-12-21T07:29:23.630Z - 2025-12-21T07:29:46.644Z Client: SSH-2.0-Go Source Port: 60128 Activities: - no_auth - Login attempt - User: search (SUCCESS) - connection - debug_channel - session - debug_channel_request - Command executed: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH uname=$(uname -s -v -n -m 2>/dev/null) arch=$(uname -m 2>/dev/null) uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1) cpus=$( (nproc || grep -c "^processor" /proc/cpuinfo) 2>/dev/null | head -1) cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ) gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50) cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || show less

2025-12-21T09:18:28.277450+02:00 6kw.fi sshd[503096]: Invalid user master from 167.99.40.241 port 53604 ...

Session Report (UTC: 2025-12-21T07:14:25.914Z) Session Duration: 2025-12-21T07:14:03.895Z - 2025-12-21T07:14:25.914Z Client: SSH-2.0-Go Source Port: 53248 Activities: - no_auth - Login attempt - User: es (SUCCESS) - connection - debug_channel - sess ... show more Session Report (UTC: 2025-12-21T07:14:25.914Z) Session Duration: 2025-12-21T07:14:03.895Z - 2025-12-21T07:14:25.914Z Client: SSH-2.0-Go Source Port: 53248 Activities: - no_auth - Login attempt - User: es (SUCCESS) - connection - debug_channel - session - debug_channel_request - Command executed: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH uname=$(uname -s -v -n -m 2>/dev/null) arch=$(uname -m 2>/dev/null) uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1) cpus=$( (nproc || grep -c "^processor" /proc/cpuinfo) 2>/dev/null | head -1) cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ) gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50) cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat show less

2025-12-21T09:03:02.895370+02:00 6kw.fi sshd[502834]: Invalid user elastic from 167.99.40.241 port 45944 ...