45.137.203.60
blockedBruteRegular
Case file
First seen on 2026-10-02T04:57:48Z, most recently active on 2026-10-04T06:42:32Z.
Recorded 56 attack-shaped requests across 3 separate days.
Its traffic probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities; it also matched a catalogue rule; it also was blocked at the edge without matching any specific attack signature.
Seen from 2 of our sensors: edge, nl4-web.
Scored into the "Brute" level, carrying the badge Regular.
Routed via AS49581 (Tube-Hosting), an ASN we classify as hosting.
Blocked on every one of our hosts and at our edge since 2026-10-04T15:29:58Z, through 2027-10-04T15:29:58Z.
Enrichment
| rDNS | tube-server.com |
|---|---|
| ASN | AS49581 — Tube-Hosting |
| ASN type | hosting |
| Country | The Netherlands (NL) |
| Flags | none observed |
Timeline
- 2026-10-0230
- 2026-10-0312
- 2026-10-0414
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-04T06:42:32Z – 2026-10-04T06:42:32Z ×2 | edge | bgpoet.com | 2 × probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-10-04T06:42:32Z","ip":"45.137.203.60","zone":"bgpoet.com","host":"bgpoet.com","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","ray… | |
| 2026-10-04T06:42:32Z – 2026-10-04T06:42:32Z ×3 | edge | bgpoet.com | 3 × was blocked at the edge without matching any specific attack signature | {"ts":"2026-10-04T06:42:32Z","ip":"45.137.203.60","zone":"bgpoet.com","host":"bgpoet.com","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","ray":"<r… | |
| 2026-10-04T06:42:32Z | edge | bgpoet.com | probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-10-04T06:42:32Z","ip":"45.137.203.60","zone":"bgpoet.com","host":"bgpoet.com","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","ray… | |
| 2026-10-04T04:44:49Z – 2026-10-04T04:44:49Z ×2 | edge | schetio.com | 2 × probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-10-04T04:44:49Z","ip":"45.137.203.60","zone":"schetio.com","host":"schetio.com","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","r… | |
| 2026-10-04T04:44:49Z – 2026-10-04T04:44:49Z ×2 | edge | schetio.com | 2 × was blocked at the edge without matching any specific attack signature | {"ts":"2026-10-04T04:44:49Z","ip":"45.137.203.60","zone":"schetio.com","host":"schetio.com","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","ray":"… | |
| 2026-10-04T04:44:49Z | edge | schetio.com | probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-10-04T04:44:49Z","ip":"45.137.203.60","zone":"schetio.com","host":"schetio.com","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","r… | |
| 2026-10-04T04:44:49Z | edge | schetio.com | was blocked at the edge without matching any specific attack signature | {"ts":"2026-10-04T04:44:49Z","ip":"45.137.203.60","zone":"schetio.com","host":"schetio.com","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","ray":"… | |
| 2026-10-04T03:28:41Z – 2026-10-04T03:28:42Z ×2 | nl4-web | bgpoet.com | 2 × probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | 404 | 45.137.203.60 - - [04/Oct/2026:06:28:42 +0300] "GET /wp-json/batch/v1 HTTP/1.1" 404 236 "-" "Mozilla/5.0" |
| 2026-10-03T22:19:24Z | edge | victorantonov.com | probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-10-03T22:19:24Z","ip":"45.137.203.60","zone":"victorantonov.com","host":"victorantonov.com","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube… | |
| 2026-10-03T22:19:24Z – 2026-10-03T22:19:24Z ×2 | edge | victorantonov.com | 2 × was blocked at the edge without matching any specific attack signature | {"ts":"2026-10-03T22:19:24Z","ip":"45.137.203.60","zone":"victorantonov.com","host":"victorantonov.com","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Host… | |
| 2026-10-03T22:19:24Z | edge | victorantonov.com | probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-10-03T22:19:24Z","ip":"45.137.203.60","zone":"victorantonov.com","host":"victorantonov.com","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube… | |
| 2026-10-03T22:19:24Z | edge | victorantonov.com | was blocked at the edge without matching any specific attack signature | {"ts":"2026-10-03T22:19:24Z","ip":"45.137.203.60","zone":"victorantonov.com","host":"victorantonov.com","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Host… | |
| 2026-10-03T22:19:24Z | edge | victorantonov.com | probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-10-03T22:19:24Z","ip":"45.137.203.60","zone":"victorantonov.com","host":"victorantonov.com","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube… | |
| 2026-10-03T16:42:21Z – 2026-10-03T16:42:22Z ×2 | nl4-web | bgpoet.com | 2 × probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | 404 | 45.137.203.60 - - [03/Oct/2026:19:42:22 +0300] "GET /wp-json/batch/v1 HTTP/1.1" 404 236 "-" "Mozilla/5.0" |
| 2026-10-03T16:15:30Z – 2026-10-03T16:23:19Z ×4 | nl4-web | schetio.com | 4 × probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | 404 | 45.137.203.60 - - [03/Oct/2026:19:23:19 +0300] "GET /wp-json/batch/v1 HTTP/1.1" 404 236 "-" "Mozilla/5.0" |
| 2026-10-02T23:29:50Z – 2026-10-02T23:29:50Z ×2 | edge | techauthors.eu | 2 × was blocked at the edge without matching any specific attack signature | {"ts":"2026-10-02T23:29:50Z","ip":"45.137.203.60","zone":"techauthors.eu","host":"techauthors.eu","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","… | |
| 2026-10-02T23:29:50Z – 2026-10-02T23:29:50Z ×3 | edge | techauthors.eu | 3 × probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-10-02T23:29:50Z","ip":"45.137.203.60","zone":"techauthors.eu","host":"techauthors.eu","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosti… | |
| 2026-10-02T23:29:49Z | edge | techauthors.eu | was blocked at the edge without matching any specific attack signature | {"ts":"2026-10-02T23:29:49Z","ip":"45.137.203.60","zone":"techauthors.eu","host":"techauthors.eu","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","… | |
| 2026-10-02T04:57:48Z | edge | techauthors.eu | matched a catalogue rule | {"ts":"2026-10-02T04:57:48Z","ip":"45.137.203.60","zone":"techauthors.eu","host":"techauthors.eu","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","… | |
| 2026-10-02T04:57:48Z | edge | techauthors.eu | probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-10-02T04:57:48Z","ip":"45.137.203.60","zone":"techauthors.eu","host":"techauthors.eu","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosti… | |
| 2026-10-02T04:57:48Z | edge | techauthors.eu | matched a catalogue rule | {"ts":"2026-10-02T04:57:48Z","ip":"45.137.203.60","zone":"techauthors.eu","host":"techauthors.eu","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","… | |
| 2026-10-02T04:57:48Z – 2026-10-02T04:57:48Z ×2 | edge | techauthors.eu | 2 × probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-10-02T04:57:48Z","ip":"45.137.203.60","zone":"techauthors.eu","host":"techauthors.eu","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosti… | |
| 2026-10-02T04:57:48Z | edge | techauthors.eu | matched a catalogue rule | {"ts":"2026-10-02T04:57:48Z","ip":"45.137.203.60","zone":"techauthors.eu","host":"techauthors.eu","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","… | |
| 2026-10-02T14:06:57Z | edge | servmoto.com | matched a catalogue rule | {"ts":"2026-10-02T14:06:57Z","ip":"45.137.203.60","zone":"servmoto.com","host":"servmoto.com","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","ray"… | |
| 2026-10-02T14:06:57Z – 2026-10-02T14:06:57Z ×2 | edge | servmoto.com | 2 × probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-10-02T14:06:57Z","ip":"45.137.203.60","zone":"servmoto.com","host":"servmoto.com","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting",… | |
| 2026-10-02T14:06:56Z – 2026-10-02T14:06:56Z ×2 | edge | servmoto.com | 2 × matched a catalogue rule | {"ts":"2026-10-02T14:06:56Z","ip":"45.137.203.60","zone":"servmoto.com","host":"servmoto.com","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","ray"… | |
| 2026-10-02T14:06:56Z | edge | servmoto.com | probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-10-02T14:06:56Z","ip":"45.137.203.60","zone":"servmoto.com","host":"servmoto.com","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting",… | |
| 2026-10-02T18:42:39Z – 2026-10-02T18:42:39Z ×2 | edge | schetio.com | 2 × matched a catalogue rule | {"ts":"2026-10-02T18:42:39Z","ip":"45.137.203.60","zone":"schetio.com","host":"schetio.com","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","ray":"… | |
| 2026-10-02T18:42:39Z – 2026-10-02T18:42:39Z ×3 | edge | schetio.com | 3 × probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-10-02T18:42:39Z","ip":"45.137.203.60","zone":"schetio.com","host":"schetio.com","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","r… | |
| 2026-10-02T18:42:39Z | edge | schetio.com | matched a catalogue rule | {"ts":"2026-10-02T18:42:39Z","ip":"45.137.203.60","zone":"schetio.com","host":"schetio.com","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","asn_org":"Ferdinand Zink trading as Tube-Hosting","ray":"… |
Report history
No abuse report sent for this address yet.
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 45.137.203.60 (mailbox goes live with phase 3). See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
