2a0f:ca80:b00b:9346::5
listedScannerRegularCampaign member
Case file
First seen on 2026-09-30T21:44:22Z, most recently active on 2026-10-04T20:25:55Z.
Recorded 112 attack-shaped requests across 4 separate days.
Its traffic read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability.
Seen from 1 of our sensors: nl4-web.
Scored into the "Scanner" level, carrying the badges Regular, Campaign member.
Routed via AS197170 (TechTies Inc.), an ASN we classify as hosting.
Publicly listed on this board, but not currently blocked on any of our hosts.
Correlated with other addresses sharing the same signature under campaign "d7cae65d7724dc68".
Enrichment
| rDNS | none |
|---|---|
| ASN | AS197170 — TechTies Inc. |
| ASN type | hosting |
| Country | Germany (DE) |
| Flags | none observed |
Timeline
- 2026-09-3014
- 2026-10-0156
- 2026-10-0314
- 2026-10-0428
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-04T20:25:55Z | nl4-web | svestnik.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:23:25:55 +0300] "GET /wp-includes/js/wp-emoji-release.min.js HTTP/1.1" 404 236 "http://svestnik.com/wp-includes/js/wp-emoji-release.min.js" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" |
| 2026-10-04T20:25:54Z – 2026-10-04T20:25:55Z ×7 | nl4-web | svestnik.com | 7 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:23:25:55 +0300] "GET /wp-content/plugins/blocksy-companion/readme.txt HTTP/1.1" 404 236 "http://svestnik.com/wp-content/plugins/blocksy-companion/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Saf… (7 distinct paths) |
| 2026-10-04T20:25:53Z | nl4-web | svestnik.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:23:25:53 +0300] "GET /wp-content/plugins/ameliabooking/Licensing/README_License.txt HTTP/1.1" 404 236 "http://svestnik.com/wp-content/plugins/ameliabooking/Licensing/README_License.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like… |
| 2026-10-04T20:25:53Z – 2026-10-04T20:25:53Z ×4 | nl4-web | svestnik.com | 4 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:23:25:53 +0300] "GET /wp-content/plugins/custom-registration-form-builder-with-submission-manager/readme.txt HTTP/1.1" 404 236 "http://svestnik.com/wp-content/plugins/custom-registration-form-builder-with-submission-manager/readme.txt" "Mozilla/5.0 (Windows NT… (4 distinct paths) |
| 2026-10-04T20:25:52Z | nl4-web | svestnik.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:23:25:52 +0300] "GET /wp-content/plugins/super-forms/documentation.txt HTTP/1.1" 404 236 "http://svestnik.com/wp-content/plugins/super-forms/documentation.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 S… |
| 2026-10-04T20:25:50Z – 2026-10-04T20:25:52Z ×3 | nl4-web | svestnik.com | 3 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:23:25:52 +0300] "GET /wp-content/plugins/visualcomposer/readme.txt HTTP/1.1" 404 236 "http://svestnik.com/wp-content/plugins/visualcomposer/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/53… (3 distinct paths) |
| 2026-10-04T09:56:26Z | nl4-web | techwriters.eu | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:12:56:26 +0300] "GET /wp-includes/js/wp-emoji-release.min.js HTTP/1.1" 404 236 "http://techwriters.eu/wp-includes/js/wp-emoji-release.min.js" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" |
| 2026-10-04T09:56:26Z – 2026-10-04T09:56:26Z ×7 | nl4-web | techwriters.eu | 7 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:12:56:26 +0300] "GET /wp-content/plugins/blocksy-companion/readme.txt HTTP/1.1" 404 236 "http://techwriters.eu/wp-content/plugins/blocksy-companion/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 S… (7 distinct paths) |
| 2026-10-04T09:56:26Z | nl4-web | techwriters.eu | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:12:56:26 +0300] "GET /wp-content/plugins/ameliabooking/Licensing/README_License.txt HTTP/1.1" 404 236 "http://techwriters.eu/wp-content/plugins/ameliabooking/Licensing/README_License.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li… |
| 2026-10-04T09:56:26Z – 2026-10-04T09:56:26Z ×4 | nl4-web | techwriters.eu | 4 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:12:56:26 +0300] "GET /wp-content/plugins/custom-registration-form-builder-with-submission-manager/readme.txt HTTP/1.1" 404 236 "http://techwriters.eu/wp-content/plugins/custom-registration-form-builder-with-submission-manager/readme.txt" "Mozilla/5.0 (Windows … (4 distinct paths) |
| 2026-10-04T09:56:26Z | nl4-web | techwriters.eu | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:12:56:26 +0300] "GET /wp-content/plugins/super-forms/documentation.txt HTTP/1.1" 404 236 "http://techwriters.eu/wp-content/plugins/super-forms/documentation.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0… |
| 2026-10-04T09:56:26Z – 2026-10-04T09:56:26Z ×3 | nl4-web | techwriters.eu | 3 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [04/Oct/2026:12:56:26 +0300] "GET /wp-content/plugins/visualcomposer/readme.txt HTTP/1.1" 404 236 "http://techwriters.eu/wp-content/plugins/visualcomposer/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/… (3 distinct paths) |
| 2026-10-03T09:08:16Z | nl4-web | schetio.com | read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:16 +0300] "GET /wp-content/plugins/ultimate-addons-for-contact-form-7/readme.txt HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/ultimate-addons-for-contact-form-7/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,… |
| 2026-10-03T09:08:16Z | nl4-web | schetio.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:16 +0300] "GET /wp-content/plugins/fusion-builder/languages/fusion-builder.pot HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/fusion-builder/languages/fusion-builder.pot" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik… |
| 2026-10-03T09:08:16Z | nl4-web | schetio.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:16 +0300] "GET /wp-content/themes/Avada/style.css HTTP/1.1" 404 236 "http://schetio.com/wp-content/themes/Avada/style.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" |
| 2026-10-03T09:08:15Z – 2026-10-03T09:08:15Z ×5 | nl4-web | schetio.com | 5 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:15 +0300] "GET /wp-content/plugins/kirki/readme.txt HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/kirki/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" (5 distinct paths) |
| 2026-10-03T09:08:15Z | nl4-web | schetio.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:15 +0300] "GET /wp-content/plugins/trx_addons/languages/trx_addons.pot HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/trx_addons/languages/trx_addons.pot" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/… |
| 2026-10-03T09:08:15Z – 2026-10-03T09:08:15Z ×4 | nl4-web | schetio.com | 4 × read a WordPress plugin's readme.txt to fingerprint its exact version for a known vulnerability | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:15 +0300] "GET /wp-content/plugins/wp-user-avatar/readme.txt HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/wp-user-avatar/readme.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537… (4 distinct paths) |
| 2026-10-03T09:08:15Z | nl4-web | schetio.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:15 +0300] "GET /wp-content/plugins/divi-form-builder/changelog.txt HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/divi-form-builder/changelog.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.… |
| 2026-10-03T09:08:15Z | nl4-web | schetio.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:15 +0300] "GET /wp-content/plugins/gravityforms/change_log.txt HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/gravityforms/change_log.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari… |
| 2026-10-03T09:08:14Z | nl4-web | schetio.com | matched a catalogue rule | 404 | 2a0f:ca80:b00b:9346::5 - - [03/Oct/2026:12:08:14 +0300] "GET /wp-content/plugins/super-forms/documentation.txt HTTP/1.1" 404 236 "http://schetio.com/wp-content/plugins/super-forms/documentation.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Sa… |
Report history
No abuse report sent for this address yet.
Campaign membership: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36|/wp-content/plug (3 addresses correlated) — no standalone campaign page yet.
Dispute or removal: [email protected] — reference 2a0f:ca80:b00b:9346::5 (mailbox goes live with phase 3). See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
