Usage Analyzer Stats

Detailed IP classifications shown one section at a time, so you can scan likely intrusion attempts, automation, mixed behavior, and legitimate website usage without the summary map getting in the way.

Cache refreshes hourly.
Last build: 2026-07-12T21:07:01+00:00

Target website filter

Scope the stats to one inferred website target.

Requests parsed
509,764
Across 8,448 IPs
Legitimate usage IPs
6,691
249,432 requests
Automation IPs
166
5,379 requests
Intrusion IPs
840
253,901 requests

Likely intrusion attempts

IPs whose requests emphasized probes, attack tooling, or heavy error-driven scanning.

IP Requests Location Signals
188.166.253.232
Likely intrusion attempt
24,429
POST (24402), GET (27) 		Singapore, Singapore Why:
  • Many distinct paths were probed
  • Targets included //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //xmlrpc.php
Paths: //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //?author=1, //?author=2, //?author=3
45.154.98.101
Likely intrusion attempt
23,351
POST (23231), GET (120) 		Lelystad, Flevoland, The Netherlands Why:
  • Targets included //xmlrpc.php, //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd
Paths: //xmlrpc.php, //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //?author=1, //?author=2
185.177.72.23
Likely intrusion attempt
18,523
GET (18490), POST (33) 		France Why:
  • Scanner-style user agents were present
  • Many distinct paths were probed
  • Targets included /app/mailjet%2eenv, /app/mailjet.env, /plugins/%2eenv
Paths: /app/mailjet%2eenv, /app/mailjet.env, /plugins/%2eenv, /%2eenv%2eold, /eRp/%2eEnV
45.154.98.108
Likely intrusion attempt
17,085
POST (17000), GET (85) 		Lelystad, Flevoland, The Netherlands Why:
  • Targets included //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //xmlrpc.php
Paths: //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //?author=1, //?author=2, //wp-json/wp/v2/users/
138.197.29.51
Likely intrusion attempt
14,376
POST (14346), GET (30) 		Clifton, New Jersey, United States Why:
  • Targets included //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //xmlrpc.php
Paths: //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //?author=1, //?author=2, //wp-json/wp/v2/users/
45.154.98.134
Likely intrusion attempt
12,383
POST (12318), GET (65) 		Lelystad, Flevoland, The Netherlands Why:
  • Targets included //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //xmlrpc.php
Paths: //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //?author=1, //?author=2, //wp-json/wp/v2/users/
45.94.31.73
Likely intrusion attempt
9,962
POST (9912), GET (50) 		Lelystad, Flevoland, The Netherlands Why:
  • Targets included //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //xmlrpc.php
Paths: //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //?author=1, //?author=2, //wp-json/wp/v2/users/
20.204.142.205
Likely intrusion attempt
8,347
POST (8327), GET (20) 		Pune, Maharashtra, India Why:
  • Targets included //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //xmlrpc.php
Paths: //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //?author=1, //?author=2, //wp-json/wp/v2/users/
185.177.72.11
Likely intrusion attempt
7,595
GET (7547), POST (48) 		France Why:
  • Scanner-style user agents were present
  • Many distinct paths were probed
  • Targets included /wp-content/themes/neve/assets/js/build/modern/frontend.js, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js, /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
Paths: /wp-content/themes/neve/assets/js/build/modern/frontend.js, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js, /, /_next, /api
185.177.72.38
Likely intrusion attempt
6,093
GET (6081), POST (12) 		France Why:
  • Scanner-style user agents were present
  • Many distinct paths were probed
  • Targets included /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings, /, /swagger.json
Paths: /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings, /, /swagger.json, /about, /contact
185.177.72.49
Likely intrusion attempt
6,014
GET (6014) 		France Why:
  • Scanner-style user agents were present
  • Many distinct paths were probed
  • Targets included /config/upload/config%2ets, /config/upload/config.ts, /test/integration/env-config/app/%2eenv
Paths: /config/upload/config%2ets, /config/upload/config.ts, /test/integration/env-config/app/%2eenv, /admin/settings%2ejson, /error%2elog%2ebak
185.177.72.54
Likely intrusion attempt
5,416
GET (5377), POST (39) 		France Why:
  • Scanner-style user agents were present
  • 70% of requests ended in 4xx/5xx responses
  • Many distinct paths were probed
  • Targets included /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings, /, /swagger.json
Paths: /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings, /, /swagger.json, /about, /contact
185.177.72.52
Likely intrusion attempt
4,695
GET (4488), POST (207) 		France Why:
  • Scanner-style user agents were present
  • 83% of requests ended in 4xx/5xx responses
  • Many distinct paths were probed
  • Targets included /wp-content/themes/neve/assets/js/build/modern/frontend.js, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js, /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
Paths: /wp-content/themes/neve/assets/js/build/modern/frontend.js, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js, /, /_next, /api
185.177.72.70
Likely intrusion attempt
3,706
GET (3646), POST (60) 		France Why:
  • Scanner-style user agents were present
  • 91% of requests ended in 4xx/5xx responses
  • Many distinct paths were probed
  • Targets included /wp-content/themes/neve/assets/js/build/modern/frontend.js, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js, /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
Paths: /wp-content/themes/neve/assets/js/build/modern/frontend.js, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js, /, /_next, /api
8.234.201.53
Likely intrusion attempt
3,508
POST (3359), GET (149) 		Washington, District of Columbia, United States Why:
  • Many distinct paths were probed
  • Targets included /wp-includes/id3/license.txt/xmlrpc.php?rsd, /wp-includes/id3/license.txt/blog/wp-includes/wlwmanifest.xml, /wp-includes/id3/license.txt/web/wp-includes/wlwmanifest.xml
Paths: /wp-includes/id3/license.txt/feed/, /wp-includes/id3/license.txt/xmlrpc.php?rsd, /wp-includes/id3/license.txt/blog/wp-includes/wlwmanifest.xml, /wp-includes/id3/license.txt/web/wp-includes/wlwmanifest.xml, /wp-includes/id3/license.txt/wordpress/wp-includes/wlwmanifest.xml
185.177.72.51
Likely intrusion attempt
3,258
GET (3033), POST (225) 		France Why:
  • Scanner-style user agents were present
  • 97% of requests ended in 4xx/5xx responses
  • Many distinct paths were probed
  • Targets included /wp-content/themes/neve/assets/js/build/modern/frontend.js, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js, /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
Paths: /wp-content/themes/neve/assets/js/build/modern/frontend.js, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js, /, /_next, /api
136.117.179.149
Likely intrusion attempt
3,179
POST (3109), GET (70) 		The Dalles, Oregon, United States Why:
  • Many distinct paths were probed
  • Targets included /wp-includes/id3/license.txt/xmlrpc.php?rsd, //xmlrpc.php?rsd, /wp-includes/id3/license.txt/blog/wp-includes/wlwmanifest.xml
Paths: /, //wp-includes/ID3/license.txt, /wp-includes/id3/license.txt/feed/, //feed/, /wp-includes/id3/license.txt/xmlrpc.php?rsd
207.175.34.130
Likely intrusion attempt
3,173
POST (3166), GET (7) 		Brussels, Brussels Capital, Belgium Why:
  • Many distinct paths were probed
  • Targets included //xmlrpc.php?rsd, //xmlrpc.php
Paths: /, //wp-includes/ID3/license.txt, //feed/, //xmlrpc.php?rsd, //?author=1
34.11.68.108
Likely intrusion attempt
2,798
POST (2791), GET (7) 		Washington, District of Columbia, United States Why:
  • Targets included //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //xmlrpc.php
Paths: /, //wp-includes/wlwmanifest.xml, //xmlrpc.php?rsd, //?author=1, //?author=2
34.48.40.151
Likely intrusion attempt
2,324
POST (2259), GET (65) 		Washington, District of Columbia, United States Why:
  • Many distinct paths were probed
  • Targets included //xmlrpc.php?rsd, /wp-includes/id3/license.txt/xmlrpc.php?rsd, /wp-includes/id3/license.txt/blog/wp-includes/wlwmanifest.xml
Paths: /, //wp-includes/ID3/license.txt, //feed/, //xmlrpc.php?rsd, /wp-includes/id3/license.txt/feed/

Automation and crawlers

Monitors, bots, and scheduled jobs that looked programmatic rather than human.

IP Requests Location Signals
192.0.91.228
Automation or crawler
2,343
HEAD (2343) 		Dallas, Texas, United States Why:
  • Traffic matches uptime monitoring
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /
192.0.84.117
Automation or crawler
2,342
HEAD (2342) 		Dallas, Texas, United States Why:
  • Traffic matches uptime monitoring
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /
130.89.144.170
Automation or crawler
40
GET (40) 		Enschede, Overijssel, The Netherlands Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /robots.txt, /
34.74.242.206
Automation or crawler
32
GET (32) 		North Charleston, South Carolina, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /robots.txt, /
192.0.91.24
Automation or crawler
21
GET (21) 		Dallas, Texas, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /feed/, /feed
18.220.198.253
Automation or crawler
18
GET (14), HEAD (4) 		Columbus, Ohio, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /robots.txt, /, /wp-content/themes/neve/assets/js/build/modern/frontend.js?ver=4.2.8, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js?ver=4.2.8, /wp-content/themes/neve/style-main-new.min.css?ver=4.2.8
2a01:4ff:1f0:1c94::1
Automation or crawler
16
GET (16) 		Hillsboro, Oregon, United States Why:
  • User agents match crawlers or scheduled jobs
Paths: /, /about-us, /contact, /about, /contacts
192.0.89.215
Automation or crawler
15
GET (15) 		Dallas, Texas, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /feed/, /feed
18.222.35.107
Automation or crawler
12
GET (9), HEAD (2), UNKNOWN (1) 		Columbus, Ohio, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /robots.txt, /, /wp-content/themes/neve/assets/js/build/modern/frontend.js?ver=4.2.8, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js?ver=4.2.8, /wp-content/themes/neve/style-main-new.min.css?ver=4.2.8
18.220.230.52
Automation or crawler
11
GET (9), HEAD (2) 		Columbus, Ohio, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /robots.txt, /, /wp-content/themes/neve/assets/js/build/modern/frontend.js?ver=4.2.8, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js?ver=4.2.8, /wp-content/themes/neve/style-main-new.min.css?ver=4.2.8
192.0.100.138
Automation or crawler
11
GET (11) 		Ashburn, Virginia, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /feed/, /feed
32.184.20.63
Automation or crawler
11
GET (9), HEAD (2) 		Boardman, Oregon, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /robots.txt, /, /wp-content/themes/neve/assets/js/build/modern/frontend.js?ver=4.2.8, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js?ver=4.2.8, /wp-content/themes/neve/style-main-new.min.css?ver=4.2.8
34.223.106.198
Automation or crawler
11
GET (9), HEAD (2) 		Boardman, Oregon, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /robots.txt, /, /wp-content/themes/neve/assets/js/build/modern/frontend.js?ver=4.2.8, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js?ver=4.2.8, /wp-content/themes/neve/style-main-new.min.css?ver=4.2.8
51.102.170.135
Automation or crawler
11
GET (9), HEAD (2) 		Frankfurt am Main, Hesse, Germany Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /robots.txt, /, /wp-content/themes/neve/assets/js/build/modern/frontend.js?ver=4.2.8, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js?ver=4.2.8, /wp-content/themes/neve/style-main-new.min.css?ver=4.2.8
2600:1f28:365:80b0:e823:552b:7d1f:c482
Automation or crawler
10
GET (10) 		Ashburn, Virginia, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /robots.txt, /mxlookup/, /whois, /whois/, /usage/
192.0.101.246
Automation or crawler
9
GET (9) 		Ashburn, Virginia, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /feed/, /feed
192.0.82.193
Automation or crawler
9
GET (9) 		Dallas, Texas, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /feed/
2600:1f28:365:80b0:6b9b:df13:3db8:edf2
Automation or crawler
8
GET (8) 		Ashburn, Virginia, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /robots.txt, /wp-sitemap.xml, /wp-sitemap-posts-page-1.xml, /wp-sitemap-taxonomies-category-1.xml, /wp-sitemap-posts-post-1.xml
2a03:2880:f800:15::
Automation or crawler
8
GET (8) 		Ashburn, Virginia, United States Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /wp-sitemap-taxonomies-category-1.xml, /wp-sitemap.xml, /about/, /2026/06/14/hello-world/, /wp-sitemap-users-1.xml
2a05:d018:1d9d:e702:6ec0:e836:aa5c:896f
Automation or crawler
8
GET (8) 		Dublin, Leinster, Ireland Why:
  • User agents match crawlers or scheduled jobs
  • Most requests completed successfully
Paths: /robots.txt, /

Mixed signals

IPs with a blend of normal traffic and suspicious or automated behavior.

IP Requests Location Signals
91.92.42.120
Mixed signals
24
UNKNOWN (24) 		Eygelshoven, Limburg, The Netherlands Why:
  • Traffic included both normal and suspicious characteristics
Paths: -
162.141.167.57
Mixed signals
11
UNKNOWN (11) 		United States Why:
  • Traffic included both normal and suspicious characteristics
Paths: -
82.39.206.116
Mixed signals
9
UNKNOWN (9) 		United Kingdom Why:
  • Traffic included both normal and suspicious characteristics
Paths: -
2001:550:9005:2000::14
Mixed signals
8
UNKNOWN (8) 		Atlanta, Georgia, United States Why:
  • Traffic included both normal and suspicious characteristics
Paths: \x16\x03\x01
2400:6180:100:d0::97f:b001
Mixed signals
8
UNKNOWN (8) 		Bengaluru, Karnataka, India Why:
  • Traffic included both normal and suspicious characteristics
Paths: LEAKIX, \x16\x03\x01\x05\xe0\x01, \x16\x03\x01\x05\xe5\x01
2604:a880:cad:d0::db0:b001
Mixed signals
8
UNKNOWN (8) 		Toronto, Ontario, Canada Why:
  • Traffic included both normal and suspicious characteristics
Paths: \x16\x03\x01\x05\xdf\x01, LEAKIX, \x16\x03\x01\x05\xda\x01, \x16\x03\x01\x05\xe1\x01
146.190.103.103
Mixed signals
7
UNKNOWN (7) 		Singapore, Singapore Why:
  • Traffic included both normal and suspicious characteristics
Paths: \x16\x03\x01\x05\xdb\x01, LEAKIX, \x16\x03\x01\x05\xdc\x01, \x16\x03\x01\x05\xe4\x01
2604:a880:4:1d0::259:0
Mixed signals
7
UNKNOWN (6), GET (1) 		Santa Clara, California, United States Why:
  • Some traffic still looked like normal browsing
Paths: /, LEAKIX, \x16\x03\x01\x05\xe0\x01, \x16\x03\x01\x05\xe3\x01
64.225.75.246
Mixed signals
7
UNKNOWN (7) 		Amsterdam, North Holland, The Netherlands Why:
  • Traffic included both normal and suspicious characteristics
Paths: \x16\x03\x01\x05\xdf\x01, \x16\x03\x01\x05\xdb\x01, LEAKIX, -
143.110.134.7
Mixed signals
6
UNKNOWN (5), GET (1) 		Santa Clara, California, United States Why:
  • Traffic included both normal and suspicious characteristics
Paths: /, Gh0st\xad, HELP, \x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc\n, \x16\x03\x01
167.99.181.249
Mixed signals
6
UNKNOWN (6) 		Toronto, Ontario, Canada Why:
  • Traffic included both normal and suspicious characteristics
Paths: \x16\x03\x01\x05\xd8\x01, LEAKIX, \x16\x03\x01\x05\xde\x01, \x16\x03\x01\x05\xe1\x01
2604:a880:cad:d0::d44:6001
Mixed signals
6
UNKNOWN (6) 		Toronto, Ontario, Canada Why:
  • Traffic included both normal and suspicious characteristics
Paths: \x16\x03\x01\x05\xe2\x01, \x16\x03\x01\x05\xde\x01, LEAKIX
2604:a880:cad:d0::db5:a001
Mixed signals
6
UNKNOWN (6) 		Toronto, Ontario, Canada Why:
  • Traffic included both normal and suspicious characteristics
Paths: \x16\x03\x01\x05\xe0\x01, LEAKIX, \x16\x03\x01\x05\xe4\x01, \x16\x03\x01\x05\xde\x01
2a10:3c0:5:0:1:22:0:5
Mixed signals
6
POST (3), GET (3) 		Portugal Why:
  • Traffic included both normal and suspicious characteristics
Paths: /mcp, /sse
164.92.244.132
Mixed signals
5
UNKNOWN (5) 		Frankfurt am Main, Hesse, Germany Why:
  • Traffic included both normal and suspicious characteristics
Paths: LEAKIX, \x16\x03\x01\x05\xd7\x01, -
165.154.62.128
Mixed signals
5
UNKNOWN (4), GET (1) 		Hong Kong, Hong Kong Why:
  • Traffic included both normal and suspicious characteristics
Paths: /, \x16\x03\x01\x01\x03\x01, \x16\x03\x01, t3 12.1.2\n
165.22.34.189
Mixed signals
5
UNKNOWN (5) 		Clifton, New Jersey, United States Why:
  • Traffic included both normal and suspicious characteristics
Paths: LEAKIX, \x16\x03\x01\x05\xda\x01
2604:a880:400:d0::24ed:1
Mixed signals
5
UNKNOWN (5) 		North Bergen, New Jersey, United States Why:
  • Traffic included both normal and suspicious characteristics
Paths: LEAKIX, \x16\x03\x01\x05\xe2\x01
2a03:b0c0:2:d0::1774:b001
Mixed signals
5
UNKNOWN (5) 		Amsterdam, North Holland, The Netherlands Why:
  • Traffic included both normal and suspicious characteristics
Paths: \x16\x03\x01\x05\xdb\x01, LEAKIX, \x16\x03\x01\x05\xdf\x01
2a03:b0c0:3:d0::12bc:e001
Mixed signals
5
UNKNOWN (5) 		Frankfurt am Main, Hesse, Germany Why:
  • Traffic included both normal and suspicious characteristics
Paths: LEAKIX, \x16\x03\x01\x05\xdb\x01, \x16\x03\x01\x05\xe2\x01

Legitimate website usage

IPs that mostly behaved like browsers fetching pages and assets.

IP Requests Location Signals
147.15.135.236
Legitimate website usage
9,802
GET (9367), POST (435) 		Montreal, Quebec, Canada Why:
  • Browser user agents dominated the activity
  • Requests arrived with human-style referers
  • Most requests were successful page or asset fetches
  • Requests focused on pages and assets rather than admin surfaces
Paths: /wp-login.php, /?author=1, /author/brad-williamsonoutlook-com/, /?author=2, /?author=3
134.185.86.184
Legitimate website usage
7,861
GET (7369), POST (486), UNKNOWN (6) 		Loyang, Singapore Why:
  • Browser user agents dominated the activity
  • Requests arrived with human-style referers
  • Most requests were successful page or asset fetches
  • Requests focused on pages and assets rather than admin surfaces
Paths: /wp-login.php, /wp-admin/index.php, /wp-login.php?redirect_to=https%3A%2F%2Fbradcentral.net%2Fwp-admin%2Findex.php&reauth=1, /?author=1, /author/brad-williamsonoutlook-com/
20.48.255.163
Legitimate website usage
7,784
GET (7780), UNKNOWN (4) 		Toronto, Ontario, Canada Why:
  • Normal page-view patterns outweighed suspicious probes
Paths: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /86.php, /bnn_.php, /35.php
146.235.16.244
Legitimate website usage
7,209
GET (6721), POST (488) 		Loyang, Singapore Why:
  • Browser user agents dominated the activity
  • Requests arrived with human-style referers
  • Most requests were successful page or asset fetches
  • Requests focused on pages and assets rather than admin surfaces
Paths: /wp-login.php, /wp-admin/index.php, /wp-login.php?redirect_to=https%3A%2F%2Fbradcentral.net%2Fwp-admin%2Findex.php&reauth=1, /?author=1, /author/brad-williamsonoutlook-com/
3.16.54.153
Legitimate website usage
6,430
GET (6426), POST (4) 		Columbus, Ohio, United States Why:
  • Browser user agents dominated the activity
  • Requests focused on pages and assets rather than admin surfaces
Paths: /.git/config, /.env, /.env.local, /.env.production, /.env.staging
3.26.39.229
Legitimate website usage
6,430
GET (6426), POST (4) 		Sydney, New South Wales, Australia Why:
  • Browser user agents dominated the activity
  • Requests focused on pages and assets rather than admin surfaces
Paths: /.git/config, /.env, /.env.local, /.env.production, /.env.staging
3.67.133.215
Legitimate website usage
5,659
GET (5655), POST (4) 		Frankfurt am Main, Hesse, Germany Why:
  • Browser user agents dominated the activity
  • Requests focused on pages and assets rather than admin surfaces
Paths: /.git/config, /, /.env, /.env.local, /.env.production
82.102.18.182
Legitimate website usage
5,253
GET (5253) 		Paris, Île-de-France, France Why:
  • Most requests were successful page or asset fetches
Paths: /wp-content/uploads/, /wp-content/uploads/2026/, /wp-content/uploads/2026//wp-content/uploads/, /wp-content/uploads/2026/wp-content/uploads/, /wp-content/uploads/2026/06/
82.102.18.190
Legitimate website usage
5,253
GET (5253) 		Paris, Île-de-France, France Why:
  • Most requests were successful page or asset fetches
Paths: /wp-content/uploads/, /wp-content/uploads/2026/, /wp-content/uploads/2026//wp-content/uploads/, /wp-content/uploads/2026/wp-content/uploads/, /wp-content/uploads/2026/06/
191.237.255.150
Legitimate website usage
5,237
GET (5236), UNKNOWN (1) 		Campinas, São Paulo, Brazil Why:
  • Normal page-view patterns outweighed suspicious probes
Paths: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /86.php, /bnn_.php, /35.php
45.148.10.62
Legitimate website usage
4,826
GET (4826) 		Amsterdam, North Holland, The Netherlands Why:
  • Browser user agents dominated the activity
  • Requests arrived with human-style referers
  • Requests focused on pages and assets rather than admin surfaces
Paths: /, /.env, /wp-content/themes/neve/assets/js/build/modern/frontend.js?ver=4.2.7, /wp-content/themes/neve/assets/js/build/modern/scroll-to-top.js?ver=4.2.7, /%2eenv
82.102.18.118
Legitimate website usage
4,783
GET (4783) 		Paris, Île-de-France, France Why:
  • Most requests were successful page or asset fetches
Paths: /wp-content/uploads/, /wp-content/uploads/2025/, /wp-content/uploads/2025//wp-content/uploads/, /wp-content/uploads/2025/wp-content/uploads/, /wp-content/uploads/2025/09/
45.148.10.51
Legitimate website usage
4,570
GET (4557), HEAD (13) 		Amsterdam, North Holland, The Netherlands Why:
  • Browser user agents dominated the activity
  • Requests arrived with human-style referers
  • Requests focused on pages and assets rather than admin surfaces
Paths: /.env.prod, /.env.old, /.env.production, /.env.local, /config/database.yml
143.244.57.118
Legitimate website usage
4,429
GET (4429) 		Paris, Île-de-France, France Why:
  • Most requests were successful page or asset fetches
Paths: /wp-content/uploads/, /wp-content/uploads/2026/, /wp-content/uploads/2026//wp-content/uploads/, /wp-content/uploads/2026/wp-content/uploads/, /wp-content/uploads/2026/06/
20.195.178.90
Legitimate website usage
3,634
GET (3634) 		Campinas, São Paulo, Brazil Why:
  • Normal page-view patterns outweighed suspicious probes
Paths: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /wp-access.php, /x.php, /wp-sing.php
20.189.200.150
Legitimate website usage
2,126
GET (2126) 		Osaka, Osaka, Japan Why:
  • Most requests were successful page or asset fetches
Paths: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /bpsoe.php, /bxodh.php, /ojgup.php
161.118.203.101
Legitimate website usage
2,009
GET (1765), POST (244) 		Loyang, Singapore Why:
  • Browser user agents dominated the activity
  • Requests arrived with human-style referers
  • Most requests were successful page or asset fetches
  • Requests focused on pages and assets rather than admin surfaces
Paths: /wp-login.php, /wp-admin/, /wp-login.php?redirect_to=https%3A%2F%2Fbradcentral.net%2Fwp-admin%2F&reauth=1, /, /wp-admin/index.php
20.151.225.63
Legitimate website usage
1,940
GET (1940) 		Toronto, Ontario, Canada Why:
  • Most requests were successful page or asset fetches
Paths: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /x.php, /wss.php, /ty.php?p=
151.243.150.222
Legitimate website usage
1,874
GET (1858), UNKNOWN (16) 		Frankfurt am Main, Hesse, Germany Why:
  • Browser user agents dominated the activity
  • Requests focused on pages and assets rather than admin surfaces
Paths: /wp-config.bak, /wp-config.php.save, /config/database.php, /wp-config.php~, /.git/HEAD
91.92.40.173
Legitimate website usage
1,867
GET (1557), POST (310) 		Eygelshoven, Limburg, The Netherlands Why:
  • Browser user agents dominated the activity
  • Requests arrived with human-style referers
  • Most requests were successful page or asset fetches
  • Requests focused on pages and assets rather than admin surfaces
Paths: /wp-login.php, /?author=1, /author/brad-williamsonoutlook-com/, /?author=2, /?author=3