Webshell-hunter fake UA "Mozlila/5.0 ... Bulid/NRD90M" requesting a store page; blocked by ModSecuri ...
show moreWebshell-hunter fake UA "Mozlila/5.0 ... Bulid/NRD90M" requesting a store page; blocked by ModSecurity CRS (403); same range as other webshell hunters.
show less
Webshell hunt: /wp-content/plugins/apikey/apikey.php, themes/seotheme/db.php, wp-plain.php with fake ...
show moreWebshell hunt: /wp-content/plugins/apikey/apikey.php, themes/seotheme/db.php, wp-plain.php with fake UA "Mozlila/5.0 ... Bulid/NRD90M"; blocked by ModSecurity CRS (403).
show less
WordPress probing on two sites: fake wp-login POSTs with spoofed referer, admin-ajax.php?action=wdps ...
show moreWordPress probing on two sites: fake wp-login POSTs with spoofed referer, admin-ajax.php?action=wdpsso_step1, /wp-json/batch/v1, meta-box-loader; rotating spoofed UAs; blocked by Wordfence WAF.
show less
WordPress probing on two sites: fake wp-login POSTs with spoofed referer, admin-ajax.php?action=wdps ...
show moreWordPress probing on two sites: fake wp-login POSTs with spoofed referer, admin-ajax.php?action=wdpsso_step1, /wp-json/batch/v1, meta-box-loader; rotating spoofed UAs; blocked by Wordfence WAF.
show less
Recon on a WordPress site: theme readme.txt, config.json, sitemap/robots with spoofed old Android/Ch ...
show moreRecon on a WordPress site: theme readme.txt, config.json, sitemap/robots with spoofed old Android/Chrome UAs.
show less
Webshell hunt: /wp-includes/core.php with fake UA "Mozlila/5.0 ... Bulid/NRD90M"; blocked by ModSecu ...
show moreWebshell hunt: /wp-includes/core.php with fake UA "Mozlila/5.0 ... Bulid/NRD90M"; blocked by ModSecurity CRS (403).
show less
WordPress probing on two sites: admin-ajax.php?action=wdpsso_step1, /wp-json/batch/v1, wp-login.php ...
show moreWordPress probing on two sites: admin-ajax.php?action=wdpsso_step1, /wp-json/batch/v1, wp-login.php under odd paths; blocked by Wordfence WAF.
show less
Scanner, ~190 requests/24h to a WordPress site via curl: /.git/HEAD, /.git/config, config.json, yarn ...
show moreScanner, ~190 requests/24h to a WordPress site via curl: /.git/HEAD, /.git/config, config.json, yarn.lock; blocked by ModSecurity CRS (403).
show less
Scanner, ~240 requests/24h to a WordPress site via curl: /.git/HEAD, /.git/config, config.json, rss- ...
show moreScanner, ~240 requests/24h to a WordPress site via curl: /.git/HEAD, /.git/config, config.json, rss-functions.php; blocked by ModSecurity CRS (403).
show less
Webshell/backdoor hunting with spoofed Mozlila UA: /wp-content/themes/seotheme/db.php /wp-content/pl ...
show moreWebshell/backdoor hunting with spoofed Mozlila UA: /wp-content/themes/seotheme/db.php /wp-content/plugins/fix/up.php /ALFA_DATA/alfacgiapi/perl.alfa /wp-plain.php
show less
Webshell filename hunting on a WordPress site, blank UA: /6.php /adminfuns.php /0.php /simple.php /w ...
show moreWebshell filename hunting on a WordPress site, blank UA: /6.php /adminfuns.php /0.php /simple.php /wp_blog_footer.php
show less
Webshell filename hunting on a WordPress site, blank UA: /wp-X1s2e6h3p7.php /ano.php /awp-berita.php ...
show moreWebshell filename hunting on a WordPress site, blank UA: /wp-X1s2e6h3p7.php /ano.php /awp-berita.php /robots.php /class-walker-footer-dev.php
show less