Automated malicious web scanning / directory traversal attack against web services. Over 6,000 reque ...
show moreAutomated malicious web scanning / directory traversal attack against web services. Over 6,000 requests probing sensitive files and environment configs including /.env, /.git/, /stripe-keys.json, and internal API endpoints.
show less
Automated vulnerability scanning and path probing targeted at WordPress core, themes, and plugins. B ...
show moreAutomated vulnerability scanning and path probing targeted at WordPress core, themes, and plugins. Blocked by Cloudflare WAF custom rules.
Key Observations:
- Request Volume: ~4,000 requests in a short timeframe.
- Behavior: Probing various sensitive paths (/wp-content/ themes and plugins, /wp-json/ REST API endpoints, uploads directory).
- Evasion Attempt: Continuously switching User-Agent headers across requests to evade basic filters.
- Result: All malicious attempts were blocked by custom WAF rules.
show less
Repeated unauthorized scanning and scraping of DSM system static files (css/js) despite web crawling ...
show moreRepeated unauthorized scanning and scraping of DSM system static files (css/js) despite web crawling restrictions. Frequent requests originating from this ASN appear to ignore robots.txt and attempt to probe web application paths (/webman/, /webapi/). Source is identified as cache.google.com but is exhibiting malicious bot behavior targeting a private NAS environment.
show less
Detected inbound port scanning activity targeting MS Terminal Server (RDP). The source IP 80.66.66.4 ...
show moreDetected inbound port scanning activity targeting MS Terminal Server (RDP). The source IP 80.66.66.40 attempted unauthorized access to my internal network host (Synology NAS). Firewall blocked the connection. Timestamp: 2026-06-03.
show less
Automated bot scanning from AS142430. Rotating User-Agents (iPhone/Windows/Linux) and sending multip ...
show moreAutomated bot scanning from AS142430. Rotating User-Agents (iPhone/Windows/Linux) and sending multiple GET/POST requests to root path within seconds. Clearly suspicious vulnerability probing.
show less
IP address
45.148.10.194
ASN
AS48090 TECHOFF SRV LIMITED
Country
Netherlands
User agent
Mozil ...
show moreIP address
45.148.10.194
ASN
AS48090 TECHOFF SRV LIMITED
Country
Netherlands
User agent
Mozilla/5.0 (compatible; SecurityScanner/1.0)
HTTP Version
HTTP/1.1
Referer
None (direct)
Method
GET
Path
/.env
Query string
Empty query string
show less
Automated web vulnerability scanner targeting WordPress paths.
The IP performed high-frequency re ...
show moreAutomated web vulnerability scanner targeting WordPress paths.
The IP performed high-frequency requests to non-existent WordPress admin and plugin paths attempting to discover vulnerable installations and backdoor files.
Examples:
/wp-admin/includes/wp-admin/js/
/wp-admin/user/interactivity-api/
/wp-includes/Requests/library/index.php
/wp-content/themes/hideo/network.php
/wp-content/wpvivid_uploads/wp-conflg.php
/wp-includes/sitemaps/providers/ultra.php
Characteristics:
- Multiple user-agent rotation (Chrome, Firefox, Linux, Mac)
- No referer
- Rapid sequential requests
- Enumeration of common WordPress backdoor locations
- ASN: AS62240 (Clouvider)
Requests were blocked by WAF rules.
This appears to be an automated mass scanning bot searching for vulnerable WordPress deployments.
show less
Multiple automated web application scanning and brute-force attempts detected.
Observed behavior: ...
show moreMultiple automated web application scanning and brute-force attempts detected.
Observed behavior:
- Scanning common vulnerable paths:
/wp-login.php
/wp-includes/
/xmlrpc.php
/phpmyadmin
/cgi-bin/
/setup.php
- Repeated requests in short time window (bursty pattern)
- Fake user agents (Chrome/Firefox versions inconsistent)
- Appears to be automated vulnerability scanner
- No legitimate browsing behavior observed
Blocked by Cloudflare WAF custom rules (sensitive path blocking)
IP is part of hosting/VPN provider ASN AS206092 and matches known abusive scanning pattern.
show less
Multiple malicious HTTP GET requests from this IP targeting common exploitation and validation paths ...
show moreMultiple malicious HTTP GET requests from this IP targeting common exploitation and validation paths.
Observed behavior:
- Empty User-Agent
- Direct requests with no referer
- Rapid scanning of multiple sensitive paths within the same second
This activity strongly indicates automated malicious web bot behavior attempting to locate misconfigured ACME validation folders or vulnerable PHP files.
Traffic was blocked by WAF custom rules.
show less
Port ScanHackingBad Web BotExploited HostWeb App Attack
Automated malicious web scanning.
IP performed rapid requests without User-Agent,
probing random P ...
show moreAutomated malicious web scanning.
IP performed rapid requests without User-Agent,
probing random PHP filenames and WordPress internal paths.
Not a verified bot. Behavior consistent with vulnerability reconnaissance.
show less
Automated scanning against a WordPress site.
Multiple requests to sensitive WordPress paths (wp-inc ...
show moreAutomated scanning against a WordPress site.
Multiple requests to sensitive WordPress paths (wp-includes, wp-content, plugins, themes) within seconds.
Used forged mobile User-Agents and search engine referrers.
Blocked by Cloudflare WAF.
show less
This IP has generated over 40,000 requests, with more than 5,000 blocked due to malicious behavior.
...
show moreThis IP has generated over 40,000 requests, with more than 5,000 blocked due to malicious behavior.
It repeatedly accessed admin paths, WordPress-related routes, and performed high-frequency scanning similar to brute-force or vulnerability probing.
All suspicious requests were mitigated by the firewall.
show less
Port ScanBrute-ForceBad Web BotExploited HostWeb App Attack
By clicking βAccept allβ, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.