Automated reconnaissance and attempted sensitive-resource discovery. 20 GET requests targeted settin ...
show moreAutomated reconnaissance and attempted sensitive-resource discovery. 20 GET requests targeted settings and application configuration files, actuator endpoints, credentials/configuration artifacts, backups, and URLs referencing 169.254.169.254 metadata.
show less
Repeated automated POST requests targeting WordPress xmlrpc.php. Supplied logs identify source 111. ...
show more Repeated automated POST requests targeting WordPress xmlrpc.php. Supplied logs identify source 111.92.130.158, not 1.92.130.158, and show repeated POST /xmlrpc.php requests from 05:00:37 to 05:04:13 UTC, each returning HTTP 200 with 403 bytes
show less
Automated probing of PHP and WordPress-related paths; no successful access evidenced.
Evidence: 20 ...
show moreAutomated probing of PHP and WordPress-related paths; no successful access evidenced.
Evidence: 20 GET requests observed on 18 Aug 2026 around 04:55 UTC; all returned HTTP 404 with 19-byte responses and 0ms latency
show less
Repeated automated WordPress login attempts targeting /wp-login.php and /wp-admin/index.php.
Eviden ...
show moreRepeated automated WordPress login attempts targeting /wp-login.php and /wp-admin/index.php.
Evidence: Multiple POST requests to /wp-login.php between 18:57:00 and 18:57:08 UTC returned HTTP 200, while access to /wp-admin/index.php repeatedly returned HTTP 302 and redirected to the login page; no successful authentication is evidenced.
show less
Confirmed malicious exploitation attempts against a WordPress server on 14 August 2026 from approxim ...
show moreConfirmed malicious exploitation attempts against a WordPress server on 14 August 2026 from approximately 13:19 to 13:21 UTC. Source IP 65.98.5.196 repeatedly targeted the WordPress REST /batch/v1 endpoint with SQL injection payloads. The attacker attempted UNION SELECT ... INTO OUTFILE to deploy PHP command shells in multiple web-accessible directories, attempted to overwrite WordPress user passwords, targeted a specific existing account, and attempted to create a new rogue WordPress account named wp_svc_5561ad.
show less
Direct command execution through malicious WordPress MU-plugin. Path /wp-content/mu-plugins/w2s_edbf ...
show moreDirect command execution through malicious WordPress MU-plugin. Path /wp-content/mu-plugins/w2s_edbf37de3c93.php?c=id. Confirmed malicious
show less
Confirmed malicious activity against a WordPress server. Source IP 204.168.207.161 sent repeated cra ...
show moreConfirmed malicious activity against a WordPress server. Source IP 204.168.207.161 sent repeated crafted requests to the WordPress REST /batch/v1 endpoint as part of an exploitation sequence, obtained an authenticated WordPress session, accessed /wp-admin/plugin-install.php, uploaded a malicious plugin through /wp-admin/update.php?action=upload-plugin, and then executed a PHP backdoor at /wp-content/plugins/w2sc8c613b73d40/direct.php. The attacker executed the id command and immediately issued rm=1 to remove the temporary backdoor. Activity is confirmed by Traefik reverse-proxy and Apache logs.
show less
High-frequency WordPress authentication probing consistent with brute-force login attempts and crede ...
show moreHigh-frequency WordPress authentication probing consistent with brute-force login attempts and credential stuffing
show less
IP 77.90.185.245 performed automated malicious reconnaissance and brute force activity against our W ...
show moreIP 77.90.185.245 performed automated malicious reconnaissance and brute force activity against our WordPress site (/wp-login.php). This activity is abusive, automated, and unauthorized.
show less
Attempted to locate login pages, VPN portals, and admin interfaces on a public server. This behaviou ...
show moreAttempted to locate login pages, VPN portals, and admin interfaces on a public server. This behaviour fits an automated reconnaissance scan designed to identify exposed authentication endpoints for later brute force attempts or exploitation.
show less
Performed a fast, automated scan against a public web server, probing for vulnerable WordPress insta ...
show morePerformed a fast, automated scan against a public web server, probing for vulnerable WordPress installations, file managers and generic PHP webshells. It requested many suspicious filenames and WordPress internal paths that are commonly used for backdoors, malware, or exploits.
show less
Performed a rapid, fully automated scan against a public web server, probing for vulnerable WordPres ...
show morePerformed a rapid, fully automated scan against a public web server, probing for vulnerable WordPress installations, file managers, and generic PHP webshells. The requests clearly target known exploit paths and typical backdoor filenames.
show less
High-speed automated scan against a public web server, attempting to discover vulnerable scripts, ad ...
show moreHigh-speed automated scan against a public web server, attempting to discover vulnerable scripts, admin panels, upload directories, and known exploit paths for WordPress and other PHP based CMS platforms.
show less
The IP 173.249.56.8 exhibits malicious behavior characterized by repeated login attempts and access ...
show moreThe IP 173.249.56.8 exhibits malicious behavior characterized by repeated login attempts and access to WordPress admin pages, indicating potential brute-force attack activity targeting web application login interfaces. This IP poses a significant security risk and should be monitored or blocked to prevent further exploitation or compromise.
show less
IP address 122.171.95.219 has been observed making repeated automated POST requests to the WordPress ...
show moreIP address 122.171.95.219 has been observed making repeated automated POST requests to the WordPress xmlrpc endpoint on our website. The requests continued at regular intervals for approximately 90 minutes. This activity appears to be an automated brute-force or probing attempt against the xmlrpc.php interface.
show less
The IP 216.24.219.44 exhibits scanning behavior targeting common web application paths, indicating p ...
show moreThe IP 216.24.219.44 exhibits scanning behavior targeting common web application paths, indicating potential reconnaissance activity. Multiple 404 responses, this activity suggests probing for vulnerabilities, increasing the risk of exploitation or further malicious actions.
show less
The IP 94.74.102.62, associated with Huawei Cloud Hong Kong, is engaging in frequent web requests to ...
show moreThe IP 94.74.102.62, associated with Huawei Cloud Hong Kong, is engaging in frequent web requests to a potentially compromised or misconfigured server, indicating possible reconnaissance or automated scanning activity.
show less
Automated scanner probed for known WordPress backdoors and upload endpoints across many common paths ...
show moreAutomated scanner probed for known WordPress backdoors and upload endpoints across many common paths, for example wp-content, wp-includes, .well-known, cgi-bin.
show less
Multiple automated requests from 178.66.130.17 targeted */tmp/* PHP endpoints on our webserver betwe ...
show moreMultiple automated requests from 178.66.130.17 targeted */tmp/* PHP endpoints on our webserver between 04:35 and 05:57 UTC on 22 September 2025. The attacker enumerated directories, accessed upload.php and user.php, executed GET parameters that appeared to run shell commands through mo.php, and wrote content into files such as obu.txt.
show less
The IP 103.134.93.142 has been observed performing multiple HTTP GET requests targeting common web a ...
show moreThe IP 103.134.93.142 has been observed performing multiple HTTP GET requests targeting common web application files and directories, indicative of reconnaissance or probing activity. It appears to be an automated probe for vulnerable WordPress sites and web shells. The requests enumerate many known backdoor filenames and WordPress core or plugin paths.
show less
The IP 35.203.134.122, exhibits high abuse potential despite its origin in a data center environment ...
show moreThe IP 35.203.134.122, exhibits high abuse potential despite its origin in a data center environment, it suggests possible misuse or malicious activity.
show less
The IP 196.251.70.149 exhibits malicious behavior indicative of web application attacks, including r ...
show moreThe IP 196.251.70.149 exhibits malicious behavior indicative of web application attacks, including repeated attempts to access wp-login.php and author enumeration, coupled with multiple POST requests to wp-login.php suggesting brute-force login attempts.
show less
The IP 165.232.180.8 exhibits suspicious activity indicative of probing or reconnaissance, targeting ...
show moreThe IP 165.232.180.8 exhibits suspicious activity indicative of probing or reconnaissance, targeting WordPress admin and upload directories.
show less
The IP 45.134.225.130 exhibits high-risk behavior indicative of a web attack, including multiple GET ...
show moreThe IP 45.134.225.130 exhibits high-risk behavior indicative of a web attack, including multiple GET requests targeting wp-login.php and author pages, followed by repeated POST attempts to wp-login.php, suggesting brute-force login attempts. The activity aligns with reconnaissance and credential guessing.
show less
Brute-ForceWeb App Attack
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.