2a0f:ca80:b00b:9346::5
listedScannerRegular
Case file
First seen on 2026-09-30T21:44:22Z, most recently active on 2026-10-04T09:56:26Z.
Recorded 98 attack-shaped requests across 4 separate days.
Its traffic read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability.
Seen from 1 of our sensors: nl4-web.
Scored into the "Scanner" level, carrying the badge Regular.
Routed via AS197170 (TechTies Inc.), an ASN we classify as hosting.
Publicly listed on this board, but not currently blocked on any of our hosts.
Enrichment
| rDNS | none |
|---|---|
| ASN | AS197170 — TechTies Inc. |
| ASN type | hosting |
| Country | Germany (DE) |
| Flags | none observed |
Timeline
- 2026-09-3014
- 2026-10-0156
- 2026-10-0314
- 2026-10-0414
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-04T09:56:26Z | nl4-web | techwriters.eu | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:12:56:26 +0300] "GET /wp-includes/js/wp-emoji-release.min.js HTTP/1.1" 404 236 "http://techwriters.eu/wp-includes/js/wp-emoji-release.min.js" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" |
| 2026-10-04T09:56:26Z – 2026-10-04T09:56:26Z ×7 | nl4-web | techwriters.eu | 7 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:12:56:26 +0300] "GET /wp-content/plugins/blocksy-companion/readme.txt HTTP/1.1" 404 236 "http://techwriters.eu/wp-content/plugins/blocksy-companion/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 S… (7 distinct paths) |
| 2026-10-04T09:56:26Z | nl4-web | techwriters.eu | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:12:56:26 +0300] "GET /wp-content/plugins/ameliabooking/Licensing/README_License.txt HTTP/1.1" 404 236 "http://techwriters.eu/wp-content/plugins/ameliabooking/Licensing/README_License.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li… |
| 2026-10-04T09:56:26Z – 2026-10-04T09:56:26Z ×4 | nl4-web | techwriters.eu | 4 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:12:56:26 +0300] "GET /wp-content/plugins/custom-registration-form-builder-with-submission-manager/readme.txt HTTP/1.1" 404 236 "http://techwriters.eu/wp-content/plugins/custom-registration-form-builder-with-submission-manager/readme.txt" "Mozilla/5.0 (Windows … (4 distinct paths) |
| 2026-10-04T09:56:26Z | nl4-web | techwriters.eu | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:12:56:26 +0300] "GET /wp-content/plugins/super-forms/documentation.txt HTTP/1.1" 404 236 "http://techwriters.eu/wp-content/plugins/super-forms/documentation.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0… |
| 2026-10-04T09:56:26Z – 2026-10-04T09:56:26Z ×3 | nl4-web | techwriters.eu | 3 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:12:56:26 +0300] "GET /wp-content/plugins/visualcomposer/readme.txt HTTP/1.1" 404 236 "http://techwriters.eu/wp-content/plugins/visualcomposer/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/… (3 distinct paths) |
| 2026-10-03T09:08:16Z | nl4-web | schetio.com | read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:16 +0300] "GET /wp-content/plugins/ultimate-addons-for-contact-form-7/readme.txt HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/ultimate-addons-for-contact-form-7/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,… |
| 2026-10-03T09:08:16Z | nl4-web | schetio.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:16 +0300] "GET /wp-content/plugins/fusion-builder/languages/fusion-builder.pot HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/fusion-builder/languages/fusion-builder.pot" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik… |
| 2026-10-03T09:08:16Z | nl4-web | schetio.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:16 +0300] "GET /wp-content/themes/Avada/style.css HTTP/1.1" 404 236 "http://schetio.com/wp-content/themes/Avada/style.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" |
| 2026-10-03T09:08:15Z – 2026-10-03T09:08:15Z ×5 | nl4-web | schetio.com | 5 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:15 +0300] "GET /wp-content/plugins/kirki/readme.txt HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/kirki/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" (5 distinct paths) |
| 2026-10-03T09:08:15Z | nl4-web | schetio.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:15 +0300] "GET /wp-content/plugins/trx_addons/languages/trx_addons.pot HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/trx_addons/languages/trx_addons.pot" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/… |
| 2026-10-03T09:08:15Z – 2026-10-03T09:08:15Z ×4 | nl4-web | schetio.com | 4 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:15 +0300] "GET /wp-content/plugins/wp-user-avatar/readme.txt HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/wp-user-avatar/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537… (4 distinct paths) |
| 2026-10-03T09:08:15Z | nl4-web | schetio.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:15 +0300] "GET /wp-content/plugins/divi-form-builder/changelog.txt HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/divi-form-builder/changelog.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.… |
| 2026-10-03T09:08:15Z | nl4-web | schetio.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:15 +0300] "GET /wp-content/plugins/gravityforms/change_log.txt HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/gravityforms/change_log.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari… |
| 2026-10-03T09:08:14Z | nl4-web | schetio.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:14 +0300] "GET /wp-content/plugins/super-forms/documentation.txt HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/super-forms/documentation.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Sa… |
| 2026-10-03T09:08:14Z – 2026-10-03T09:08:14Z ×4 | nl4-web | schetio.com | 4 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:14 +0300] "GET /wp-content/plugins/visualcomposer/readme.txt HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/visualcomposer/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537… (4 distinct paths) |
| 2026-10-01T09:33:36Z | nl4-web | svestnik.com | read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [01/Oct/2026:12:33:36 +0300] "GET /wp-content/plugins/ultimate-addons-for-contact-form-7/readme.txt HTTP/1.1" 404 236 "http://svestnik.com/wp-content/plugins/ultimate-addons-for-contact-form-7/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML… |
| 2026-10-01T09:33:35Z | nl4-web | svestnik.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [01/Oct/2026:12:33:35 +0300] "GET /wp-content/plugins/fusion-builder/languages/fusion-builder.pot HTTP/1.1" 404 236 "http://svestnik.com/wp-content/plugins/fusion-builder/languages/fusion-builder.pot" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li… |
| 2026-10-01T09:33:35Z | nl4-web | svestnik.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [01/Oct/2026:12:33:35 +0300] "GET /wp-content/themes/Avada/style.css HTTP/1.1" 404 236 "http://svestnik.com/wp-content/themes/Avada/style.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" |
| 2026-10-01T09:33:35Z – 2026-10-01T09:33:35Z ×5 | nl4-web | svestnik.com | 5 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [01/Oct/2026:12:33:35 +0300] "GET /wp-content/plugins/kirki/readme.txt HTTP/1.1" 404 236 "http://svestnik.com/wp-content/plugins/kirki/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" (5 distinct paths) |
| 2026-10-01T09:33:35Z | nl4-web | svestnik.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [01/Oct/2026:12:33:35 +0300] "GET /wp-content/plugins/trx_addons/languages/trx_addons.pot HTTP/1.1" 404 236 "http://svestnik.com/wp-content/plugins/trx_addons/languages/trx_addons.pot" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome… |
| 2026-10-01T09:33:35Z – 2026-10-01T09:33:35Z ×4 | nl4-web | svestnik.com | 4 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [01/Oct/2026:12:33:35 +0300] "GET /wp-content/plugins/wp-user-avatar/readme.txt HTTP/1.1" 404 236 "http://svestnik.com/wp-content/plugins/wp-user-avatar/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/53… (4 distinct paths) |
Report history
No abuse report sent for this address yet.
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 2a0f:ca80:b00b:9346::5 (mailbox goes live with phase 3). See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
