Hunting for config files and secrets against a web application, blocked at the host firewall.
fail2b ...
show moreHunting for config files and secrets against a web application, blocked at the host firewall.
fail2ban jail: js-detector.
Sample requests, with our own hostnames removed:
136.66.209.16 - - [12/Sep/2026:02:48:02 +1000] "GET /.git/config HTTP/1.1" 403 1242 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
136.66.209.16 - - [12/Sep/2026:02:48:06 +1000] "GET /.git/config HTTP/1.1" 403 1242 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
show less
Hammering the XML-RPC endpoint against a web application, blocked at the host firewall.
fail2ban jai ...
show moreHammering the XML-RPC endpoint against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
172.216.181.228 - - [12/Sep/2026:04:29:01 +1000] "POST /xmlrpc.php HTTP/1.1" 403 1242 "-" "Jetpack by WordPress.com"
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
151.123.177.200 - - [12/Sep/2026:04:59:38 +1000] "POST /wp-json/batch/v1 HTTP/1.1" 403 1131 "-" "CMS-Security-Auditor/1.0 (+authorized self-check; contact: local-admin)"
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
Sample reques ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
Sample requests, with our own hostnames removed:
209.50.173.211 - 2026-09-12 04:57:02 - CMS-Security-Auditor/1.0 (+authorized self-check; contact: local-admin) - - - /wp-login.php
show less
Hammering the XML-RPC endpoint against a web application, blocked at the host firewall.
Sample reque ...
show moreHammering the XML-RPC endpoint against a web application, blocked at the host firewall.
Sample requests, with our own hostnames removed:
216.26.230.240 - 2026-09-12 04:57:22 - CMS-Security-Auditor/1.0 (+authorized self-check; contact: local-admin) - - - /xmlrpc.php
show less
Hunting for config files and secrets against a web application, blocked at the host firewall.
fail2b ...
show moreHunting for config files and secrets against a web application, blocked at the host firewall.
fail2ban jail: js-detector.
Sample requests, with our own hostnames removed:
35.230.125.166 - - [12/Sep/2026:01:43:37 +1000] "GET /.git/config HTTP/1.1" 403 1242 "-" "-"
35.230.125.166 - - [12/Sep/2026:02:04:24 +1000] "GET /.git/config HTTP/1.1" 403 1242 "-" "-"
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
138.3.223.188 - - [12/Sep/2026:04:52:16 +1000] "GET /wp-login.php HTTP/2" 403 63 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
185.177.72.45 - - [12/Sep/2026:05:20:01 +1000] "GET /wp-json/ HTTP/1.1" 403 1242 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
62.60.130.142 - - [12/Sep/2026:06:39:30 +1000] "GET /wp-login.php HTTP/1.1" 403 44 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:121.0) Gecko/20100101 Firefox/121.0"
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
149.118.62.200 - - [12/Sep/2026:05:32:44 +1000] "GET /wp-login.php HTTP/2" 403 63 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36"
show less
Hammering the XML-RPC endpoint against a web application, blocked at the host firewall.
Sample reque ...
show moreHammering the XML-RPC endpoint against a web application, blocked at the host firewall.
Sample requests, with our own hostnames removed:
160.238.109.246 - 2026-09-12 06:41:48 - Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 - - - /xmlrpc.php
show less
Hammering the XML-RPC endpoint against a web application, blocked at the host firewall.
fail2ban jai ...
show moreHammering the XML-RPC endpoint against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
192.145.125.94 - - [12/Sep/2026:06:06:30 +1000] "GET //xmlrpc.php?rsd HTTP/1.1" 403 63 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
129.151.153.54
129.151.153.54 - - [12/Sep/2026:08:27:58 +1000] "GET /wp-login.php HTTP/2" 403 44 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1; rv:121.0) Gecko/20100101 Firefox/121.0"
show less
Hammering the XML-RPC endpoint against a web application, blocked at the host firewall.
fail2ban jai ...
show moreHammering the XML-RPC endpoint against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
146.70.160.236 - - [12/Sep/2026:07:02:41 +1000] "GET //xmlrpc.php?rsd HTTP/2" 403 63 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
146.70.160.236 - 2026-09-11 16:24:26 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 - - - //xmlrpc.php?rsd
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
Sample reques ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
Sample requests, with our own hostnames removed:
200.13.197.179 - 2026-09-12 07:36:37 - Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 - - - /wp-login.php
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
40.77.167.132 - - [12/Sep/2026:08:48:46 +1000] "GET /wp-content/uploads/2018/10/At-The-Centre-There-Is-Nothing.jpg HTTP/2" 403 1242 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36"
40.77.167.132 - - [10/Sep/2026:04:08:36 +1000] "GET /wp-content/uploads/2024/04/Early-Mornings-67x30cm-BRONZE-WITH-PATINA-Table-topBronze-Figurative-mela-cooke-australian-female-sculpture-1-150x150.jpg HTTP/2" 403 1242 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36"
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
Sample reques ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
Sample requests, with our own hostnames removed:
65.111.0.20 - 2026-09-12 08:58:14 - CMS-Security-Auditor/1.0 (+authorized self-check; contact: local-admin) - - - /wp-login.php
show less
Hammering the XML-RPC endpoint against a web application, blocked at the host firewall.
Sample reque ...
show moreHammering the XML-RPC endpoint against a web application, blocked at the host firewall.
Sample requests, with our own hostnames removed:
65.111.0.172 - 2026-09-12 08:58:33 - CMS-Security-Auditor/1.0 (+authorized self-check; contact: local-admin) - - - /xmlrpc.php
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
65.111.6.197 - - [12/Sep/2026:09:31:47 +1000] "POST /wp-json/batch/v1 HTTP/1.1" 403 1131 "-" "CMS-Security-Auditor/1.0 (+authorized self-check; contact: local-admin)"
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
65.111.12.240 - - [12/Sep/2026:09:00:42 +1000] "POST /wp-json/batch/v1 HTTP/1.1" 403 1131 "-" "CMS-Security-Auditor/1.0 (+authorized self-check; contact: local-admin)"
show less
Attempting SQL injection against a web application.
Sample requests, with our own hostnames removed: ...
show moreAttempting SQL injection against a web application.
Sample requests, with our own hostnames removed:
194.36.27.158 - - [12/Sep/2026:09:31:44 +1000] "GET /resources/css/?ND=%20AND%20EXTRACTVALUE%288082%2CCONCAT%280x7e%2C%28%28SELECT%20%28ELT%288082%3D8082%2C1%29%29%29%29%2C0x7e%29%29--%20- HTTP/1.1" 200 2914 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
show less
Hammering the XML-RPC endpoint against a web application, blocked at the host firewall.
Sample reque ...
show moreHammering the XML-RPC endpoint against a web application, blocked at the host firewall.
Sample requests, with our own hostnames removed:
209.50.163.4 - 2026-09-12 09:29:31 - CMS-Security-Auditor/1.0 (+authorized self-check; contact: local-admin) - - - /xmlrpc.php
show less
Hunting for config files and secrets against a web application, blocked at the host firewall.
fail2b ...
show moreHunting for config files and secrets against a web application, blocked at the host firewall.
fail2ban jail: js-detector.
Sample requests, with our own hostnames removed:
34.177.118.196 - - [12/Sep/2026:01:15:55 +1000] "GET /.git/config HTTP/1.1" 403 1242 "-" "-"
34.177.118.196 - - [12/Sep/2026:03:33:12 +1000] "GET /.git/config HTTP/1.1" 403 1242 "-" "-"
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
fail2ban jail: cartt-probe.
Sample requests, with our own hostnames removed:
65.111.14.63 - - [12/Sep/2026:09:56:09 +1000] "GET /wp-login.php HTTP/1.1" 403 63 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0"
show less
Probing for a WordPress login against a web application, blocked at the host firewall.
Sample reques ...
show moreProbing for a WordPress login against a web application, blocked at the host firewall.
Sample requests, with our own hostnames removed:
190.121.23.218 - 2026-09-12 09:42:43 - Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 - - - /wp-login.php
show less
Web App Attack
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.