62.60.130.247
Case file
First seen on 2026-09-12T07:50:44Z, most recently active on 2026-09-28T08:23:04Z.
Recorded 30 attack-shaped requests across 2 separate days.
Its traffic matched a catalogue rule; it also probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities.
Seen on our edge sensor.
Scored into the "Scanner" level, carrying the badge Regular.
Routed via AS215930 (Cipher Operations Doo Beograd - Novi Beograd), an ASN we classify as residential.
Publicly listed on this board, but not currently blocked on any of our hosts.
Enrichment
| rDNS | none |
|---|---|
| ASN | AS215930 — Cipher Operations Doo Beograd - Novi Beograd |
| ASN type | residential |
| Country | Iran (IR) |
| Flags | none observed |
Timeline
- 2026-09-126
- 2026-09-2824
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-09-28T08:23:03Z – 2026-09-12T07:50:45Z ×12 | edge | 2 sites | 12 × matched a catalogue rule | {"ts":"2026-09-12T07:50:45Z","ip":"62.60.130.247","zone":"zmey.eu","host":"zmey.eu","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","action":"block","source":"firewallManaged","rul… | |
| 2026-09-28T00:52:19Z – 2026-09-28T00:52:20Z ×6 | edge | odor-ex.com | 6 × matched a catalogue rule | {"ts":"2026-09-28T00:52:20Z","ip":"62.60.130.247","zone":"odor-ex.com","host":"odor-ex.com","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","action":"block","source":"firewallManag… | |
| 2026-09-28T01:20:51Z – 2026-09-28T01:20:52Z ×6 | edge | haiv.dev | 6 × probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | {"ts":"2026-09-28T01:20:52Z","ip":"62.60.130.247","zone":"haiv.dev","host":"haiv.dev","path":"/wp-json/batch/v1","method":"POST","query":"","ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","action":"block","source":"firewallManage… | |
| 2026-09-28T05:48:08Z – 2026-09-28T05:48:09Z ×6 | edge | beholder-europe.com | 6 × matched a catalogue rule | {"ts":"2026-09-28T05:48:09Z","ip":"62.60.130.247","zone":"beholder-europe.com","host":"beholder-europe.com","path":"/","method":"POST","query":"<truncated>","ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","action":"block","source… |
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 62.60.130.247. See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
