UA inconsistency between GET and POST (FB_IAB missing on first request), 7x simultaneous admin-ajax ...
show moreUA inconsistency between GET and POST (FB_IAB missing on first request), 7x simultaneous admin-ajax calls targeting registration page – part of ongoing coordinated botnet attack since 2026-04-29
show less
ARMember-specific login endpoint probing (/arm-login/), infrastructure subdomain scanning, switching ...
show moreARMember-specific login endpoint probing (/arm-login/), infrastructure subdomain scanning, switching between .at and .com domains – part of ongoing coordinated attack since 2026-04-29
show less
Targeted members-only content access attempt, POST on / after access denial – part of ongoing coordi ...
show moreTargeted members-only content access attempt, POST on / after access denial – part of ongoing coordinated botnet attack since 2026-04-29
show less
Fake iPadOS 26.3.1 (OS doesn't exist), systematic login enumeration targeting /einloggen-2 – part of ...
show moreFake iPadOS 26.3.1 (OS doesn't exist), systematic login enumeration targeting /einloggen-2 – part of ongoing coordinated botnet attack since 2026-04-29
show less
Source map enumeration (.css.map, .js.map files) to identify plugin versions and code structure for ...
show moreSource map enumeration (.css.map, .js.map files) to identify plugin versions and code structure for vulnerability research – confirmed by AbuseIPDB report 'trolling for resource vulnerabilities' from same day
show less
Fake iOS 26.4.2 (OS doesn't exist), fbclid cover, POST on /, simultaneous admin-ajax calls – part of ...
show moreFake iOS 26.4.2 (OS doesn't exist), fbclid cover, POST on /, simultaneous admin-ajax calls – part of ongoing coordinated botnet attack since 2026-04-29
show less
fbclid cover without referrer (fake), POST on /, simultaneous admin-ajax and BetterDocs REST API cal ...
show morefbclid cover without referrer (fake), POST on /, simultaneous admin-ajax and BetterDocs REST API calls – part of ongoing coordinated botnet attack since 2026-04-29
show less
Headless browser, POST on /, simultaneous admin-ajax calls – part of ongoing coordinated botnet atta ...
show moreHeadless browser, POST on /, simultaneous admin-ajax calls – part of ongoing coordinated botnet attack since 2026-04-29. Previous DDoS participation confirmed.
show less
PHP webshell enumeration, scanning for uploaded shells in wp-admin subdirectories – automated scanne ...
show morePHP webshell enumeration, scanning for uploaded shells in wp-admin subdirectories – automated scanner
show less
Credential stuffing attack, systematic login enumeration including password reset endpoint /einlogge ...
show moreCredential stuffing attack, systematic login enumeration including password reset endpoint /einloggen-2/?action=lostpassword – part of ongoing coordinated attack since 2026-04-29
show less
Headless browser mimicking outdated Firefox/Windows 7, POST on / after every GET – part of ongoing c ...
show moreHeadless browser mimicking outdated Firefox/Windows 7, POST on / after every GET – part of ongoing coordinated botnet attack since 2026-04-29
show less
Fake Android 16 (OS doesn't exist), fbclid cover, simultaneous POST on / and admin-ajax – part of on ...
show moreFake Android 16 (OS doesn't exist), fbclid cover, simultaneous POST on / and admin-ajax – part of ongoing coordinated botnet attack since 2026-04-29
show less
Headless browser, POST on /, multiple simultaneous admin-ajax calls, fake Safari version (26.4 doesn ...
show moreHeadless browser, POST on /, multiple simultaneous admin-ajax calls, fake Safari version (26.4 doesn't exist) – part of ongoing coordinated botnet attack since 2026-04-29
show less
Fake ChatGPT-User bot from Azure Phoenix, sequential participant ID enumeration – identical attack p ...
show moreFake ChatGPT-User bot from Azure Phoenix, sequential participant ID enumeration – identical attack pattern to 2026-05-12 campaign
show less
Automated forum search with double-encoded UTF-8 (encoding error typical of bots), targeted thematic ...
show moreAutomated forum search with double-encoded UTF-8 (encoding error typical of bots), targeted thematic search term without prior page visit – part of ongoing coordinated attack against alkohol-ade.com since 2026-04-29
show less
Fake meta-externalagent crawler from Meta IP range, systematic forum crawling with multiple parallel ...
show moreFake meta-externalagent crawler from Meta IP range, systematic forum crawling with multiple parallel IPs from same /24, confirmed by multiple independent sources (CrowdSec, Fail2Ban). Not legitimate Meta crawler – no correlation with actual Facebook page activity.
show less
Fake crawler with non-existent contact URL (crawler.example), probing security.txt – not a legitimat ...
show moreFake crawler with non-existent contact URL (crawler.example), probing security.txt – not a legitimate security researcher
show less
Automated wpForo signup endpoint probing, direct navigation to /aa-login/?wpforo=signup without huma ...
show moreAutomated wpForo signup endpoint probing, direct navigation to /aa-login/?wpforo=signup without human browsing pattern
show less
BASE64-encoded PHP webshell upload attempt, CRITICAL severity, identical payload to ongoing attack c ...
show moreBASE64-encoded PHP webshell upload attempt, CRITICAL severity, identical payload to ongoing attack campaign
show less
Web App AttackHacking
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.