Auto-ban: 12 malicious requests on 2026-03-12 (e.g., env/backup probes, brute-force, or error bursts ...
show moreAuto-ban: 12 malicious requests on 2026-03-12 (e.g., env/backup probes, brute-force, or error bursts).
show less
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: CA, Attack patterns: Word ...
show moreBlocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: CA, Attack patterns: WordPress scanning
show less
Automated vulnerability scanning and backdoor probing detected. The actor is systematically targetin ...
show moreAutomated vulnerability scanning and backdoor probing detected. The actor is systematically targeting the root domain to locate known web shells and exploit WordPress-specific administrative files and directories.
Observed Activity:
Backdoor Hunting: Probing for malicious scripts: /ws.php, /sf.php, /wp-good.php, and /chosen.php.
WordPress Exploitation: Systematic scanning of /wp-admin/user/index.php, /wp-trackback.php, and the /wp-includes/PHPMailer/ directory.
Infrastructure Reconnaissance: Targeting non-standard files like /autoload_classmap.php, /adminfuns.php, and /class-t.api.php to identify potential remote code execution (RCE) entry points.
Method: High-frequency automated HTTP GET requests (16+ requests within a single second), indicative of a botnet-driven exploit scanner.
Intent: Identifying vulnerabilities or existing server compromises to facilitate unauthorized access.
show less
[ISILIA Protection v2.1] Tentative d'accès: /info.php | Pays: CA | UA: Mozilla/5.0 (Windows NT 10.0; ...
show more[ISILIA Protection v2.1] Tentative d'accès: /info.php | Pays: CA | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Sa
show less
Hacking
Web App Attack
Showing 1 to
15
of 165 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩