Auto-ban: 288 malicious requests on 2025-12-24 (e.g., env/backup probes, brute-force, or error burst ...
show moreAuto-ban: 288 malicious requests on 2025-12-24 (e.g., env/backup probes, brute-force, or error bursts).
show less
This IP was detected 12 times on my original honeypot and also performed automated reconnaissance an ...
show moreThis IP was detected 12 times on my original honeypot and also performed automated reconnaissance and vulnerability scanning against my server between 2025-12-24T12:39:36Z UTC and 2025-12-24T12:40:00Z UTC.
The honeypot files included examples such as: /wp-content/plugins/hellopress/wp_filemanager.php, /themes.php, /404.php, /about.php, /file.php, /item.php and others.
It issued 50 HTTP requests targeting 12 distinct suspicious paths within about 24 seconds.
The targeted paths included examples such as: /wp-conflg.php, /function.php, /upload.php, /13.php, /wp-cron.php, /alfa-rex.php and others.
Some requests targeted file manager scripts commonly abused for remote code execution (e.g. filemanager or elfinder dialogs).
Multiple requests used filenames that resemble PHP web shells or exploitation payloads.
The behavior is consistent with an automated directory and CMS reconnaissance scan, not normal user browsing.
show less