Repeated SYN port scan media service (port 32400) plus malicious-fingerprint HTTP probes; blackliste ...
show moreRepeated SYN port scan media service (port 32400) plus malicious-fingerprint HTTP probes; blacklisted with 15+ reports.
Target: A host media server on port 32400; SYN port scan + malicious-fingerprint HTTP probes
Seen: 2026-10-27 15:07 EDT
- 2026-10-27 15:07:17 Malicious Fingerprint alert, Critical severity, flow to port 32400
- 2026-10-27 15:07:14 Suspicious HTTP Header alert, flow to port 32400
- 2026-10-27 13:27 third-party report: repeated SYN port scan against port 32400, blocked by UFW
- 2026-10-26 third-party report: host sweep across 52 distinct destinations
show less
WordPress credential brute-force and REST API user enumeration against an exposed WordPress site; al ...
show moreWordPress credential brute-force and REST API user enumeration against an exposed WordPress site; all login/API attempts blocked at the edge.
Target: WordPress site on 443; wp-login.php credential brute-force (GET/POST) + /wp-json/wp/v2/users/me REST user enumeration
Seen: 2026-10-27 15:49 EDT
- 2026-10-27 15:49:10 GET /wp-login.php HTTP/2.0 → 403 at edge
- 2026-10-27 15:49:11 POST /wp-login.php HTTP/2.0 → 403 at edge
- 2026-10-27 15:49:12 GET /wp-login.php HTTP/2.0 → 403 at edge
- 2026-10-27 15:49:11 GET /wp-json/wp/v2/users/me HTTP/2.0 → 401 at edge
- 2026-10-27 15:49:13 GET /wp-json/wp/v2/users/me HTTP/2.0 → 401 at edge
show less
Automated scanner sweeping secret/sensitive paths (WordPress/OpenCart style) against the internet-fa ...
show moreAutomated scanner sweeping secret/sensitive paths (WordPress/OpenCart style) against the internet-facing web service; all requests terminated at the edge.
Target: HTTP 80/443 edge service; secret-file/path sweep of /wp-admin/css/, /sites/default/files/, /admin/controller/extension/extension/, /uploads/, /images/, /.well-known/
Seen: 2026-10-27 15:59 EDT
- 2026-10-27 15:59:17 GET /wp-admin/css/ HTTP/1.1 → 404 at edge
- 2026-10-27 15:59:25 GET /sites/default/files/ HTTP/1.1 → 404 at edge
- 2026-10-27 15:59:27 GET /admin/controller/extension/extension/ HTTP/1.1 → 404 at edge
- 2026-10-27 15:59:30 GET /uploads/ HTTP/1.1 → 404 at edge
- 2026-10-27 15:59:34 GET /images/ HTTP/1.1 → 403 at edge
- 2026-10-27 15:59:22 GET /.well-known/ HTTP/1.1 → 404 at edge
show less
Malicious-fingerprint HTTP scanner probing the internet-facing web service on port 80; blacklisted w ...
show moreMalicious-fingerprint HTTP scanner probing the internet-facing web service on port 80; blacklisted with 400+ reports.
Target: Web service port 80; Malicious-Fingerprint scan (Emergency severity)
Seen: 2026-10-27 15:53 EDT
- 2026-10-27 15:53:41 flow to internal port 80 flagged Malicious Fingerprint, Emergency severity
- 2026-10-27 15:53:36 same range probe observed against port 80
- 2026-10-27 09:00 third-party report: firewall-blocked port 80 port scan from this address
show less
Suspicious-HTTP-header scanner probing the internet-facing web service on port 80; blacklisted with ...
show moreSuspicious-HTTP-header scanner probing the internet-facing web service on port 80; blacklisted with 170+ reports.
Target: Web service port 80; Suspicious HTTP Header probe (Emergency severity)
Seen: 2026-10-27 15:53 EDT
- 2026-10-27 15:53:43 flow to internal port 80 flagged Suspicious Header, Emergency severity
- 2026-10-27 16:01 third-party report: blacklisted IP, hacking activity
- 2026-10-27 10:01 third-party report: automated HTTP connection/probe attempts over port 80
- 2026-10-26 third-party report: GET / HTTP/1.1 with HTTP Banner Detection user-agent on port 80
show less
Brute-forced our WordPress site: repeated failed wp-login.php POST/GET attempts and wp-json user enu ...
show moreBrute-forced our WordPress site: repeated failed wp-login.php POST/GET attempts and wp-json user enumeration.
Target: HTTP 80 / HTTPS 443: wp-login.php brute force and /wp-json/wp/v2/users/me enumeration
Seen: 2026-10-27 13:22 EDT
- 2026-10-27 13:22:43-44 a host: GET /wp-login.php -> 403, GET /.well-known/index.php -> 404 from 82.211.137.71
- 2026-10-27 13:22:49-50 a host: POST /wp-login.php -> 403, GET /wp-login.php -> 403 from 82.211.137.71 (WordPress 7.1.3 vhost)
- 2026-10-27 13:22:44-50 a host: GET /wp-json/wp/v2/users/me -> 401 x3 from 82.211.137.71 (user enumeration)
- 2026-10-27 : 82.211.137.71 generated 9x level-10 'Multiple web server 400 error codes from same source ip' events
show less
Probed wp-login.php, repeatedly. All payloads were blocked at the edge (301/403) and never reached t ...
show moreProbed wp-login.php, repeatedly. All payloads were blocked at the edge (301/403) and never reached the WordPress backend.
Target: GET /wp-login.php
Seen: 2026-10-27 13:50-13:51 EDT
- 2026-10-27 13:50:28 IDS 'ET WEB_SPECIFIC_APPS WordPress Core wp2shell Remote Code Execution (CVE-2026-63030 & CVE-2026-60137)' matched POST from 164.92.246.117:57719 -> port 80
- 2026-10-27 13:50:28 IDS 'Possible SQL Injection UNION SELECT in HTTP Request Body' matched from 164.92.246.117:57719 -> port 80
- 2026-10-27 13:50:28 IDS 'Possible SQL Injection SELECT CONCAT in HTTP Request Body' matched from 164.92.246.117:57719 -> port 80
- 2026-10-27 13:50:50-13:51:19 firewall blocked repeated TCP from 164.92.246.117:66440 -> port 80 and :443 after the exploit burst
show less
Swept ~25 secret/config files (.env variants, .git/config, /) against a host at port 443 from a Goog ...
show moreSwept ~25 secret/config files (.env variants, .git/config, /) against a host at port 443 from a Google data-center IP; all requests were rejected.
Target: HTTPS 443, secret/.env/.git file enumeration
Seen: 2026-10-27 12:09-12:10 EDT
- 12:09:33 GET /.env /.a host /.env.prod /.env.dev /.env.example /.env.backup /.env.bak /.git/config and POST / — all → 403
- 12:09:34-35 GET /.env2 /.env2 /.env2 (continuing) — all → 403
show less
Attempted the Realtek SDK command-execution/backdoor exploit (CVE-2021-35394) against the edge host ...
show moreAttempted the Realtek SDK command-execution/backdoor exploit (CVE-2021-35394) against the edge host on UDP/9034; packet blocked at the firewall.
Target: UDP 9034 on edge host — Realtek SDK command-execution exploit
Seen: 2026-10-27 12:16 EDT
- 12:16:53 IDS ET EXPLOIT Realtek SDK - Command Execution/Backdoor Access (CVE-2021-35394): UDP 47.95.30.206:56418 -> port 9034
- 12:16:54 firewall: block of the same UDP packet from 47.95.30.206 to port 9034
show less
Brute-forced WordPress from a Russian ISP with repeated /wp-login.php POST attempts and /wp-json/wp/ ...
show moreBrute-forced WordPress from a Russian ISP with repeated /wp-login.php POST attempts and /wp-json/wp/v2/users/me probes; all requests returned 403/401.
Target: WordPress /wp-login.php and /wp-json/wp/v2/users/me
Seen: 2026-10-27 12:01 EDT
- 12:01:43-45 a host: POST /wp-login.php from 79.126.115.175 on host a host → 403 (multiple failed logins)
- 12:01:42-46 a host: GET /wp-json/wp/v2/users/me from 79.126.115.175 → 401 (unauthenticated user enumeration)
show less
Netiface Frankfurt host sent a TCP SYN to the internal MySQL port 3306, matched by IDS as a suspicio ...
show moreNetiface Frankfurt host sent a TCP SYN to the internal MySQL port 3306, matched by IDS as a suspicious scan.
Target: MySQL 3306, single TCP SYN scan from external host, blocked at firewall
Seen: 2026-10-27 11:26 EDT
- 2026-10-27 11:26:39 IDS ET SCAN Suspicious inbound to mySQL port 3306 64.89.163.94:54742 -> port 3306
- 2026-10-27 11:26:39 firewall: block in TCP 64.89.163.94:54742 -> port 3306 pfB_PRI1_v4
show less
Backup and CMS paths with repeated HEAD requests.
Target: HTTP 80/443, HEAD sweep of /home /wordpres ...
show moreBackup and CMS paths with repeated HEAD requests.
Target: HTTP 80/443, HEAD sweep of /home /wordpress /new /old /main /backup /wp /bc /bk, all 404
Seen: 2026-10-27 12:00 EDT
- 2026-10-27 12:00:28 a host: HEAD /home 404, HEAD /wordpress 404, HEAD /backup 404
- 2026-10-27 12:00:27 a host: HEAD /new 404, HEAD /old 404, HEAD /main 404, HEAD /wp 404
- 2026-10-27 12:00:26 a host: HEAD /bc 404, HEAD /bk 404, HEAD / 200
show less
Scanned for WordPress Gravity SMTP CVE-2026-4020 unauthenticated REST API flaw and swept for secret/ ...
show moreScanned for WordPress Gravity SMTP CVE-2026-4020 unauthenticated REST API flaw and swept for secret/env/config files against our network's public HTTP service.
Target: HTTP 80, WordPress Gravity SMTP REST API /wp-json/gravitysmtp/v1/tests/mock-data plus secret-file sweep (/.env, /.git/.config, /config.php)
Seen: 2026-10-27 10:43 EDT
- 2026-10-27 10:43:32 - GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1 -> 301 on port 80, UA Mozilla/5.0 (compatible; lightspeed)
- 2026-10-27 10:43:32 - GET /.env, /git/.config, /config.php, / -> 301 on port 80, same source IP 85.155.14.18
- 2026-10-27 10:43:32 - IDS 1:2069346:1 'WordPress Plugin Gravity SMTP Unauthenticated REST API (CVE-2026-4020)' fired for 85.155.14.18 -> port 80
- 2026-10-27 10:43:33 - Possible Exploit alert for flow 85.155.14.18:56222 -> public HTTP service port 80
show less
A Google Cloud IP swept a public-facing web server with ~30 requests probing for secret files (.env, ...
show moreA Google Cloud IP swept a public-facing web server with ~30 requests probing for secret files (.env, .git-credentials, private keys, helm values.yaml), path-traversal into /proc/self/environ, GraphQL, and WordPress admin endpoints, all returning 403/404.
Target: HTTP/HTTPS web server — secret-file sweep (.env.production, .git-credentials, privatekey.key, values.yaml), path traversal (/userfiles?path=../../../../proc/self/environ and /userfiles/x?path=../.....
Seen: 2026-10-27 09:03 EDT
- 2026-10-27 09:03:29 - GET /userfiles?path=../../../../proc/self/environ HTTP/1.1 -> 403
- 2026-10-27 09:03:31 - GET /userfiles/x?path=../../.env HTTP/1.1 -> 403
- 2026-10-27 09:03:31 - GET /.git-credentials -> 403
- 2026-10-27 09:03:30 - GET /.env.production -> 403
- 2026-10-27 09:03:31 - GET /privatekey.key -> 404
- 2026-10-27 09:03:28 - GET /values.yaml -> 404
- 2026-10-27 09:03:30 - POST /v1/graphql -> 404
- 2026-10-27 09:03:35 - GET /wp-admin/ -> 403
show less
Swept for exposed secret files (.git/config) against the public HTTP service.
Target: HTTP 80, GET / ...
show moreSwept for exposed secret files (.git/config) against the public HTTP service.
Target: HTTP 80, GET /.git/config (secret-file sweep)
Seen: 2026-10-27 08:25 EDT
- 2026-10-27 08:25:28 - GET /.git/config HTTP/1.1 from 45.138.12.21 returned 403
- 2026-10-27 08:25:27 - GET /.git/config HTTP/1.1 from 45.138.12.21 returned 403
show less
Probed the public HTTP service with a malicious traffic fingerprint; ThinkPHP CVE exploitation repor ...
show moreProbed the public HTTP service with a malicious traffic fingerprint; ThinkPHP CVE exploitation reported elsewhere).
Target: HTTP 80
Seen: 2026-10-27 07:54 EDT
- 07:54:36 UTC — traffic sensor flagged a Malicious Fingerprint flow: 152.236.14.113:44368 → public HTTP port 80
- 07:54:27 UTC — inbound TCP connection 152.236.14.113:44368 → port 80 accepted at the edge
show less
Probed the public HTTP service with a malicious traffic fingerprint; repeated port scans reported el ...
show moreProbed the public HTTP service with a malicious traffic fingerprint; repeated port scans reported elsewhere).
Target: HTTP 80
Seen: 2026-10-27 07:12 EDT
- 07:12:19 UTC — traffic sensor flagged a Malicious Fingerprint flow: 207.175.214.187:47075 → public HTTP port 80
- 07:12:13 UTC — inbound TCP connection 207.175.214.187:47075 → port 80 accepted at the edge
show less
Sent an HTTP probe with a suspicious/empty header and python-requests user-agent to the public HTTP ...
show moreSent an HTTP probe with a suspicious/empty header and python-requests user-agent to the public HTTP service; 130 reports).
Target: HTTP 80, GET /
Seen: 2026-10-27 07:29 EDT
- 07:29:02 UTC — traffic sensor flagged an HTTP Suspicious Header flow: 34.14.49.196:38818 → public HTTP port 80
- 07:28:57 UTC — HTTP GET / with python-requests/2.34.2 user-agent on port 80 returned a closed (444) response
show less
Probed the public HTTPS service with a malicious traffic fingerprint; flagged as Ghostfleet bot/port ...
show moreProbed the public HTTPS service with a malicious traffic fingerprint; flagged as Ghostfleet bot/port scan elsewhere).
Target: HTTPS 443
Seen: 2026-10-27 07:09 EDT
- 07:09:25 UTC — traffic sensor flagged a Malicious Fingerprint flow: 34.78.248.220:47024 → public HTTPS port 443
- 07:09:18 UTC — inbound TCP connection 34.78.248.220:47024 → port 443 accepted at the edge
show less
Hit port 80 with a protocol-confusion request (duplicate Connection header keep-alive, close, flagge ...
show moreHit port 80 with a protocol-confusion request (duplicate Connection header keep-alive, close, flagged Suspicious Header) — blocked at the proxy (444).
Target: HTTP 80 a host — GET / with malformed/duplicate Connection header
Seen: 2026-10-27 06:35 EDT
- 06:35:41 GET / HTTP/1.1 -> 444 on port 80 from 43.163.206.70
- 06:35:49 HTTP Suspicious Header flow port 80 <- 43.163.206.70
show less
Hit port 80 with a secret-file sweep (/.git/config, /.env via Keydrop.io/onlyscans fingerprint, Poss ...
show moreHit port 80 with a secret-file sweep (/.git/config, /.env via Keydrop.io/onlyscans fingerprint, Possible Exploit) — all blocked at the proxy (444).
Target: HTTP 80 a host — /.git/config, /.env (Keydrop.io scan)
Seen: 2026-10-27 06:28 EDT
- 06:28:09 GET /.git/config HTTP/1.1 -> 444 (Keydrop.io/onlyscans)
- 06:28:09 GET /.env HTTP/1.1 -> 444 (Keydrop.io/onlyscans)
- 06:28:15 Possible Exploit flow port 80 <- 23.239.27.128
show less
Scanned a host (HTTP/2 :443) with a ~40-path secret/environment/terraform/AWS-credential sweep (/.en ...
show moreScanned a host (HTTP/2 :443) with a ~40-path secret/environment/terraform/AWS-credential sweep (/.env, /.aws/credentials.json, /cloudformation.yml, /.git/HEAD, /openai-proxy.yml); all returned 404.
Target: HTTPS 443 a host — /.env, /.aws/credentials, /cloudformation.yml, /.git, /openai-proxy.yml
Seen: 2026-10-27 06:18 EDT
- 06:18:34 HTTP/2 GET /.env -> 404
- 06:18:34 HTTP/2 GET /.aws/credentials.json -> 404
- 06:18:34 HTTP/2 GET /cloudformation.yml -> 404
- 06:18:34 HTTP/2 GET /bedrock/config.json -> 404
- 06:18:50 HTTP/2 GET /.git/HEAD -> 404
show less
Web App Attack
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.