Public bot-trap analytics. Every hit below is a scanner wasting its time on fake WordPress pages, honeypot credentials, and slow-drip responses. Site names are masked; IPs are reduced to /24 + a stable bot ID.
| xmlrpc-bruteforce | |
| xmlrpc | |
| wp-probe | |
| env | |
| probe | |
| git | |
| xmlrpc-multicall | |
| admin | |
| login-page | |
| login | |
| xmlrpc-listmethods | |
| xmlrpc-pingback |
| p***.com | |
| h********.com | |
| h********.com | |
| j*********.com | |
| j*******.com | |
| h********.net | |
| r****.us | |
| s*********.com | |
| m********.com | |
| l********.com | |
| p*******.com | |
| c******.com | |
| b************.com | |
| p*******.org | |
| k******.com | |
| f****.com | |
| a*****.com | |
| q**.dev | |
| j******.com | |
| p*******.com |
| /xmlrpc.php | |
| /wp-login.php | |
| /wp-content/ | |
| /wp-json/wp/v2/users | |
| /wp-good.php | |
| /.env | |
| /.git/config | |
| /wp-json/wp/v2/users/..;/ | |
| /.env.production | |
| /wp-index.php | |
| /wp-includes/SimplePie/admin.php | |
| /config.php | |
| /wp-includes/widgets/ | |
| /.env.local | |
| /admin.php | |
| /wp-includes/interactivity-api/index.php | |
| /wp-content/plugins/WordPressCore/ | |
| /wp-mail.php | |
| /wp-themes.php | |
| /.env.bak |
| Bot | Subnet | Hits | Sites |
|---|---|---|---|
| bot_3f39 | 185.177.72.xxx | 5.5K | 22 |
| bot_5d17 | 122.160.151.xxx | 5.3K | 26 |
| bot_4900 | 20.151.131.xxx | 5.0K | 33 |
| bot_3f6e | 52.187.249.xxx | 4.4K | 40 |
| bot_23a0 | 172.212.188.xxx | 4.1K | 29 |
| bot_626c | 172.190.142.xxx | 3.8K | 44 |
| bot_c1b9 | 4.193.168.xxx | 3.5K | 38 |
| bot_e1c4 | 172.202.75.xxx | 3.2K | 42 |
| bot_2643 | 20.9.81.xxx | 3.2K | 26 |
| bot_d049 | 103.121.156.xxx | 3.2K | 20 |
| bot_7652 | 52.243.57.xxx | 3.0K | 34 |
| bot_a61b | 87.121.84.xxx | 2.9K | 19 |
| bot_c5be | 23.101.4.xxx | 2.8K | 28 |
| bot_0e3e | 23.101.8.xxx | 2.8K | 35 |
| bot_7eb5 | 20.226.60.xxx | 2.7K | 26 |
POSTs to /xmlrpc.php classified by method. Auth attempts on wp.getUsersBlogs / metaWeblog.* / blogger.* get a fake admin success that poisons the attacker's credential database. pingback.* always returns a fault so the tarpit can't be used as an SSRF reflector.
| publish | |
| lkxkfway6080bbt | |
| prd683wxdeir6ugjp | |
| dg3hsmu9lkmpkco | |
| 1w6bgfrcilhe1t | |
| inao4mcl540vf6 | |
| 0lypz8fr0qz7oxi | |
| i9xltwya80fowu8wq2 | |
| y7jc45f314ykbb | |
| 7dwicaw4bnnm7cpo | |
| ru12bawpip1z0z4e | |
| wlguf8rsstlmspebw | |
| a3k7u7yiz7wfu6f | |
| vjdjuw0f1ptlw1 | |
| a5vzwafmzinlb2ff |
decrypted, masked to first 2 chars + length, ≥3 attempts, email-shaped values dropped
| po** | |
| zw****** | |
| 12****** | |
| ef******* | |
| 10******** | |
| pl****** | |
| se******* | |
| ny**** | |
| t0***** | |
| lq******** | |
| 6u**** | |
| l3**** | |
| 89******* | |
| zg***** | |
| fm****** |
| IN | |
| BR | |
| US | |
| PK | |
| ID | |
| PH | |
| NL | |
| CA | |
| AE | |
| NP | |
| TR | |
| GB |
| AS55836 Reliance Jio Infocomm Limited | |
| AS24560 Bharti Airtel Limited | |
| AS8075 Microsoft Corporation | |
| AS9829 Broadband Multiplay Project, O/o DGM BB, | |
| AS5384 Emirates Telecommunications Corporation | |
| AS14061 DigitalOcean, LLC | |
| AS45609 Bharti Airtel Limited | |
| AS14593 SpaceX Services, Inc. | |
| AS9299 HOME_DSL | |
| AS48090 TECHOFF SRV LIMITED | |
| AS208972 GIBIRNET ILETISIM HIZMETLERI SANAYI VE T | |
| AS9541 Cyber Internet Services Pakistan | |
| AS5769 Videotron Ltee | |
| AS17557 Pakistan Telecommuication company limite | |
| AS7713 PT Telekomunikasi Indonesia |