Public bot-trap analytics. Every hit below is a scanner wasting its time on fake WordPress pages, honeypot credentials, and slow-drip responses. Site names are masked; IPs are reduced to /24 + a stable bot ID.
All-time totals since 2026-03-31 · "Last 24 Hours" is the only windowed card
| xmlrpc-bruteforce | |
| xmlrpc | |
| wp-probe | |
| env | |
| probe | |
| git | |
| xmlrpc-multicall | |
| admin | |
| login-page | |
| xmlrpc-listmethods | |
| login | |
| xmlrpc-pingback |
| p********.live | |
| f**.dev | |
| f*********.com | |
| k******.com | |
| r****.us | |
| q**.dev | |
| p*******.org | |
| f****.com | |
| t************.com | |
| s*************.com | |
| q**.dev | |
| f******.dev | |
| p*******.com | |
| p*************.com | |
| j*********.com | |
| k******.com | |
| r************.com | |
| l********.com | |
| j*******.com | |
| c******.com |
| /xmlrpc.php | |
| /wp-login.php | |
| /wp-json/wp/v2/users | |
| /wp-content/ | |
| /.env | |
| /.git/config | |
| /wp-includes/SimplePie/admin.php | |
| /wp-good.php | |
| /.env.production | |
| /admin.php | |
| /wp-links.php | |
| /.env.backup2 | |
| /.env.dev | |
| /wp-load.php | |
| /.env.bak | |
| /wp-file.php | |
| /wp-back.php | |
| /config.php | |
| /wp-json/gravitysmtp/v1/tests/mock-data | |
| /wp-content/plugins/core-plugin/include.php |
| Bot | Subnet | Hits | Sites |
|---|---|---|---|
| bot_6e12 | 122.180.21.xxx | 44.3K | 57 |
| bot_5bbe | 149.34.210.xxx | 26.9K | 50 |
| bot_1df0 | 114.198.138.xxx | 26.4K | 55 |
| bot_d049 | 103.121.156.xxx | 24.8K | 54 |
| bot_332d | 158.23.184.xxx | 18.2K | 40 |
| bot_87db | 62.60.130.xxx | 17.3K | 57 |
| bot_6003 | 119.93.249.xxx | 17.2K | 52 |
| bot_328a | 111.235.68.xxx | 14.6K | 46 |
| bot_77c8 | 46.162.203.xxx | 14.3K | 44 |
| bot_ddfc | 203.122.45.xxx | 13.7K | 49 |
| bot_497c | 103.138.51.xxx | 13.5K | 45 |
| bot_8378 | 103.249.82.xxx | 12.5K | 47 |
| bot_f4d7 | 94.187.171.xxx | 12.0K | 47 |
| bot_64c1 | 149.34.210.xxx | 11.1K | 46 |
| bot_8dfe | 45.148.10.xxx | 10.5K | 84 |
POSTs to /xmlrpc.php classified by method. Auth attempts on wp.getUsersBlogs / metaWeblog.* / blogger.* get a fake admin success that poisons the attacker's credential database. pingback.* always returns a fault so the tarpit can't be used as an SSRF reflector.
| publish | |
| 5pcjntc7w12awk3ip | |
| 3n6nk1audwayiy | |
| vx8rkna77bnibssuq6 | |
| j095ooy2fvu7bqv1lq | |
| khz5v6f8zcnvwks1 | |
| 66xjv2kwn0yxp2h71m | |
| b3c3665x13zrtlbpqa | |
| jys0ttp9ems2fdujf | |
| 4uvbjugglqjggpn | |
| 01tzzru3lpk6c1jx | |
| r9j2c21ry5olh3z5v | |
| dfwwuyistm7mx8 | |
| 2ge0v1w448d07vjsi | |
| j21ikzwlpe1ckk5a98 |
decrypted, masked to first 2 chars + length, ≥3 attempts, email-shaped values dropped
| po** | |
| rc**** | |
| hf***** | |
| jr***** | |
| nr**** | |
| nt**** | |
| sx****** | |
| hg******* | |
| 4x***** | |
| d8**** | |
| 8v******** | |
| sm**** | |
| sh******** | |
| 5g******** | |
| zk******** |
| IN | |
| PK | |
| BR | |
| ID | |
| US | |
| PH | |
| NL | |
| AE | |
| BE | |
| LT | |
| DE | |
| BD |
| AS55836 Reliance Jio Infocomm Limited | |
| AS396982 Google LLC | |
| AS24560 Bharti Airtel Limited | |
| AS9829 Broadband Multiplay Project, O/o DGM BB, | |
| AS215930 CIPHER OPERATIONS DOO BEOGRAD - NOVI BEO | |
| AS5384 Emirates Telecommunications Corporation | |
| AS14593 SpaceX Services, Inc. | |
| AS9541 Cyber Internet Services Pakistan | |
| AS17557 Pakistan Telecommuication company limite | |
| AS218785 TC DATACENTER LIMITED MANAGED IP SPACE | |
| AS8452 TE Data | |
| AS14061 DigitalOcean, LLC | |
| AS45609 Bharti Airtel Limited | |
| AS9829 NIB (National Internet Backbone) | |
| AS7713 PT Telekomunikasi Indonesia |