The Watchtower — Live Ops

Events per hour — 7 days

Live feed

• 2026-10-04T22:53:56Z 213.209.159.133 32 requests on 32 distinct paths — requested a .env file, hoping to find API keys or database credentials (×18); fuzzed a short, random filename looking for a forgotten script that responds (×5); requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot (×3); +5 more kinds
• 2026-10-04T22:52:53Z–2026-10-04T22:52:54Z 185.95.156.182 4 requests on 2 distinct paths — requested wp-login.php to check whether this site runs WordPress (×2); probed a WordPress admin/content path used to fingerprint the installation or hunt for an exposed upload/plugin surface (×2)
• 2026-10-04T22:52:41Z 94.154.43.31 requested an absolute URL instead of a path, testing whether this server behaves as an open forward proxy
• 2026-10-04T22:52:18Z–2026-10-04T22:52:27Z 35.201.174.126 92 requests on 85 distinct paths — requested a .env file, hoping to find API keys or database credentials (×37); used a directory-traversal segment (literal or percent-encoded ../) in the request path to try to escape the web root (×27); requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot (×13); +6 more kinds
• 2026-10-04T22:20:00Z–2026-10-04T22:52:24Z 195.178.110.159 4 requests on 4 distinct paths — probed for an exposed .svn directory to read the site's version-control metadata (×2); requested the .git directory itself, hoping it is exposed and browsable (×1); probed for an exposed .git directory to download the site's source history and config (×1)
• 2026-10-04T22:51:54Z–2026-10-04T22:52:06Z 104.208.73.227 50 requests on 50 distinct paths — fuzzed a short, random filename looking for a forgotten script that responds
• 2026-10-04T22:45:13Z–2026-10-04T22:45:16Z 74.161.160.33 3 requests on 3 distinct paths — requested xmlrpc.php, which exposes a multicall method commonly abused to spray WordPress credentials and relay pingback floods (×1); probed a WordPress admin/content path used to fingerprint the installation or hunt for an exposed upload/plugin surface (×1); requested wp-login.php to check whether this site runs WordPress (×1)
• 2026-10-04T22:44:53Z 161.118.226.254 read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability
• 2026-10-04T22:41:29Z–2026-10-04T22:41:30Z 203.159.90.90 18 requests on 18 distinct paths — requested a WordPress core file used to fingerprint the installed version and active plugins (×17); requested xmlrpc.php, which exposes a multicall method commonly abused to spray WordPress credentials and relay pingback floods (×1)
• 2026-10-04T22:40:33Z–2026-10-04T22:40:36Z 192.227.203.228 18 requests on 18 distinct paths — requested a WordPress core file used to fingerprint the installed version and active plugins (×17); requested xmlrpc.php, which exposes a multicall method commonly abused to spray WordPress credentials and relay pingback floods (×1)
• 2026-10-04T22:38:26Z 93.123.109.167 16 requests on 8 distinct paths — requested wp-login.php to check whether this site runs WordPress
• 2026-10-04T22:35:19Z–2026-10-04T22:36:32Z 20.214.109.68 11 requests on 11 distinct paths — requested a WordPress core file used to fingerprint the installed version and active plugins (×3); probed wp-includes/PHPMailer/, a WordPress core library directory commonly used to drop a webshell after a prior compromise (×3); probed a WordPress admin/content path used to fingerprint the installation or hunt for an exposed upload/plugin surface (×3); +2 more kinds
• 2026-10-04T22:31:16Z–2026-10-04T22:31:34Z 20.210.186.186 36 requests on 36 distinct paths — fuzzed a short, random filename looking for a forgotten script that responds (×31); requested wp-login.php to check whether this site runs WordPress (×3); fuzzed a common filename under /cgi-bin/, looking for a forgotten legacy CGI script (×2)
• 2026-10-04T22:24:53Z–2026-10-04T22:30:26Z 213.209.159.223 156 requests on 154 distinct paths — requested a .env file, hoping to find API keys or database credentials (×118); requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot (×12); requested a database dump or site archive by its common backup filename (×6); +10 more kinds
• 2026-10-04T22:29:36Z–2026-10-04T22:29:53Z 20.204.16.113 69 requests on 69 distinct paths — fuzzed a short, random filename looking for a forgotten script that responds (×63); probed a WordPress admin/content path used to fingerprint the installation or hunt for an exposed upload/plugin surface (×4); requested a filename commonly used by web shells left behind by a previous compromise (×1); +1 more kind

Top ASNs

Top 10 countries