Public bot-trap analytics. Every hit below is a scanner wasting its time on fake WordPress pages, honeypot credentials, and slow-drip responses. Site names are masked; IPs are reduced to /24 + a stable bot ID.
All-time totals since 2026-03-31 · "Last 24 Hours" is the only windowed card
| xmlrpc-bruteforce | |
| xmlrpc | |
| wp-probe | |
| env | |
| probe | |
| git | |
| admin | |
| xmlrpc-multicall | |
| login-page | |
| xmlrpc-listmethods | |
| login | |
| xmlrpc-pingback |
| p********.live | |
| p*******.com | |
| l********.com | |
| j*******.com | |
| f******.dev | |
| r****.us | |
| j*********.com | |
| s*************.com | |
| q**.dev | |
| r************.com | |
| h********.com | |
| f**.dev | |
| j******.com | |
| h********.net | |
| c******.com | |
| k******.com | |
| p*************.com | |
| p*******.org | |
| p*******.com | |
| s*********.com |
| /xmlrpc.php | |
| /wp-login.php | |
| /wp-json/wp/v2/users | |
| /.env | |
| /wp-content/ | |
| /wp-good.php | |
| /.git/config | |
| /wp-links.php | |
| /wp-includes/SimplePie/admin.php | |
| /wp-content/plugins/core-plugin/include.php | |
| /wp-includes/css/ | |
| /.env.production | |
| /admin.php | |
| /.env.dev | |
| /.env.backup2 | |
| /config.php | |
| /.env.bak | |
| /wp-includes/css/alfa-rex.php | |
| /wp-index.php | |
| /wp-content/themes/seotheme/db.php |
| Bot | Subnet | Hits | Sites |
|---|---|---|---|
| bot_6e12 | 122.180.21.xxx | 22.3K | 53 |
| bot_d049 | 103.121.156.xxx | 13.3K | 47 |
| bot_1df0 | 114.198.138.xxx | 13.1K | 49 |
| bot_5bbe | 149.34.210.xxx | 10.9K | 45 |
| bot_6003 | 119.93.249.xxx | 9.0K | 35 |
| bot_d22a | 161.118.254.xxx | 8.2K | 5 |
| bot_8dfe | 45.148.10.xxx | 7.9K | 84 |
| bot_77c8 | 46.162.203.xxx | 7.7K | 33 |
| bot_497c | 103.138.51.xxx | 7.3K | 35 |
| bot_a46a | 20.226.26.xxx | 6.9K | 63 |
| bot_c747 | 110.93.211.xxx | 6.7K | 31 |
| bot_328a | 111.235.68.xxx | 6.3K | 31 |
| bot_8378 | 103.249.82.xxx | 6.3K | 31 |
| bot_399e | 187.16.107.xxx | 6.1K | 29 |
| bot_26e3 | 80.246.225.xxx | 6.0K | 8 |
POSTs to /xmlrpc.php classified by method. Auth attempts on wp.getUsersBlogs / metaWeblog.* / blogger.* get a fake admin success that poisons the attacker's credential database. pingback.* always returns a fault so the tarpit can't be used as an SSRF reflector.
| publish | |
| cpkdfkqcq1ds5wq1 | |
| at7jsts4tx2k0mgghy | |
| u9z4bgvq7ow0crqks | |
| x7xrglkp2xj99bsp | |
| 2meshom8zjeu4u | |
| n6k65vc1wl0s4larzy | |
| yeykms6x5pkuavlyy | |
| pxyj0dwbqpgd0f | |
| 9vd0jsllhmewtj | |
| 04asm7uhxnzt1xo5e5 | |
| u5q6c85tm66t8ii | |
| cewcnbjg15i1dtqmt | |
| ck914capltdawf | |
| kx21ofatyv9sdjritl |
decrypted, masked to first 2 chars + length, ≥3 attempts, email-shaped values dropped
| po** | |
| 8n******* | |
| 7x******* | |
| 1s******* | |
| h9**** | |
| h6****** | |
| 5p******** | |
| 1b**** | |
| z9******** | |
| g1******* | |
| uc**** | |
| h4******* | |
| 6b***** | |
| ku******** | |
| 9s******** |
| IN | |
| PK | |
| BR | |
| US | |
| PH | |
| ID | |
| AE | |
| NP | |
| NL | |
| BD | |
| CA | |
| DE |
| AS55836 Reliance Jio Infocomm Limited | |
| AS24560 Bharti Airtel Limited | |
| AS8075 Microsoft Corporation | |
| AS8075 Microsoft Limited | |
| AS5384 Emirates Telecommunications Corporation | |
| AS9829 Broadband Multiplay Project, O/o DGM BB, | |
| AS9829 NIB (National Internet Backbone) | |
| AS14593 SpaceX Services, Inc. | |
| AS17557 Pakistan Telecommuication company limite | |
| AS45609 Bharti Airtel Limited | |
| AS7713 PT Telekomunikasi Indonesia | |
| AS7713 PT TELKOM INDONESIA | |
| AS9541 Cyber Internet Services Pakistan | |
| AS18881 TELEFÔNICA BRASIL S.A | |
| AS8452 TE Data |