Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
WordPress credential stuffing against chalkwild.com. At 22/Oct/2026:18:31:13 +0000 this IP sent POST /wp-login.php (HTTP 200 = authentication failed) presenting User-Agent "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, li ...
show moreWordPress credential stuffing against chalkwild.com. At 22/Oct/2026:18:31:13 +0000 this IP sent POST /wp-login.php (HTTP 200 = authentication failed) presenting User-Agent "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like ". It made exactly ONE request to the site all day: that bare login POST. It never issued GET /wp-login.php, so it never loaded the login form it submitted to -- a browser cannot post a form it did not fetch, and a human who mistyped a password would reload and retry. It sent a forged Referer naming the login page to disguise the missing fetch. One of 17 distinct IPs doing this on the same day, each firing a single blind POST, which is a distributed credential-stuffing botnet spreading attempts across hosts to stay under per-IP rate limits. Zero successful logins; the account credentials were rotated during incident remediation on 2026-08-17.
show less
This address requests our sites over plain http, is answered with a redirect to https, and never follows it — over and over. A browser follows redirects; a scanner enumerating hosts does not. It reads nothing it asks for and only loads the server; bl ...
show moreThis address requests our sites over plain http, is answered with a redirect to https, and never follows it — over and over. A browser follows redirects; a scanner enumerating hosts does not. It reads nothing it asks for and only loads the server; blocked. Please check what runs on this address. | method: GET | path: /wp-login.php | 2026-09-24 10:43 UTC
show less
