WordPress credential stuffing against chalkwild.com. 21/Oct/2026:01:01:18 UTC: POST /wp-login.php, H ...
show moreWordPress credential stuffing against chalkwild.com. 21/Oct/2026:01:01:18 UTC: POST /wp-login.php, HTTP 200 (auth failed). This address made exactly ONE request to the site all day - the bare login POST - and never issued GET /wp-login.php, so it never loaded the form it submitted to; that rules out a human mistyping a password. UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36. Part of a distributed campaign: 33 distinct IPs, one login POST each, evenly paced roughly every 10 minutes from 00:21 to 05:34 UTC, rotating Chrome UA strings across Mac/Windows/Linux - one attempt per address, deliberately tuned to stay under per-IP rate limits. Zero successful logins.
show less
WordPress credential stuffing against chalkwild.com. 21/Oct/2026:02:20:07 UTC: POST /wp-login.php, H ...
show moreWordPress credential stuffing against chalkwild.com. 21/Oct/2026:02:20:07 UTC: POST /wp-login.php, HTTP 200 (auth failed). This address made exactly ONE request to the site all day - the bare login POST - and never issued GET /wp-login.php, so it never loaded the form it submitted to; that rules out a human mistyping a password. UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36. Part of a distributed campaign: 33 distinct IPs, one login POST each, evenly paced roughly every 10 minutes from 00:21 to 05:34 UTC, rotating Chrome UA strings across Mac/Windows/Linux - one attempt per address, deliberately tuned to stay under per-IP rate limits. Zero successful logins.
show less
WordPress credential stuffing against chalkwild.com. 21/Oct/2026:01:21:11 UTC: POST /wp-login.php, H ...
show moreWordPress credential stuffing against chalkwild.com. 21/Oct/2026:01:21:11 UTC: POST /wp-login.php, HTTP 200 (auth failed). This address made exactly ONE request to the site all day - the bare login POST - and never issued GET /wp-login.php, so it never loaded the form it submitted to; that rules out a human mistyping a password. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36. Part of a distributed campaign: 33 distinct IPs, one login POST each, evenly paced roughly every 10 minutes from 00:21 to 05:34 UTC, rotating Chrome UA strings across Mac/Windows/Linux - one attempt per address, deliberately tuned to stay under per-IP rate limits. Zero successful logins.
show less
WordPress credential stuffing against chalkwild.com. 21/Oct/2026:03:49:28 UTC: POST /wp-login.php, H ...
show moreWordPress credential stuffing against chalkwild.com. 21/Oct/2026:03:49:28 UTC: POST /wp-login.php, HTTP 200 (auth failed). This address made exactly ONE request to the site all day - the bare login POST - and never issued GET /wp-login.php, so it never loaded the form it submitted to; that rules out a human mistyping a password. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36. Part of a distributed campaign: 33 distinct IPs, one login POST each, evenly paced roughly every 10 minutes from 00:21 to 05:34 UTC, rotating Chrome UA strings across Mac/Windows/Linux - one attempt per address, deliberately tuned to stay under per-IP rate limits. Zero successful logins.
show less
WordPress credential stuffing against chalkwild.com. 21/Oct/2026:01:31:40 UTC: POST /wp-login.php, H ...
show moreWordPress credential stuffing against chalkwild.com. 21/Oct/2026:01:31:40 UTC: POST /wp-login.php, HTTP 200 (auth failed). This address made exactly ONE request to the site all day - the bare login POST - and never issued GET /wp-login.php, so it never loaded the form it submitted to; that rules out a human mistyping a password. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36. Part of a distributed campaign: 33 distinct IPs, one login POST each, evenly paced roughly every 10 minutes from 00:21 to 05:34 UTC, rotating Chrome UA strings across Mac/Windows/Linux - one attempt per address, deliberately tuned to stay under per-IP rate limits. Zero successful logins.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less
Requested known WordPress backdoor/scanner-only paths (config backups, .env, .git/config). No legiti ...
show moreRequested known WordPress backdoor/scanner-only paths (config backups, .env, .git/config). No legitimate use.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less
HTTP authentication attempt against WordPress using an attacker-created account name that was delete ...
show moreHTTP authentication attempt against WordPress using an attacker-created account name that was deleted during incident remediation. The account does not exist on this host, so no legitimate client can authenticate as it; the source is replaying credentials planted during a prior compromise.
show less