Real Threat Intelligence Platform

Why Are These IP Addresses Listed?

1. Requests targeting PHP files that legitimate visitors normally never access.
2. Large numbers of requests to root PHP files within a short period.
3. Typical web shell filenames such as shell.php, x.php, fileXX.php and wp-load.php probes.
4. Often originates from VPS or cloud infrastructure.
5. After reaching the threshold the IP is added to the dynamic firewall layer and blocked at network level.

Matched Patterns

Observed Behavior

• Known webshell and fake WordPress core filenames are requested directly.
• The scanner looks for backdoors left by previous compromises.
• Requests often arrive in bursts against the same domain.
• Any 200/500 response for these paths should be investigated on the server.

Why Are These IP Addresses Listed?

1. Requests for sensitive files such as .env, .env.backup, .pypirc, credentials, secrets.json and api_keys.json.
2. Probing for exposed project files, .git directories, config files, SQL dumps, backups and old copies.
3. Requests to discovery endpoints such as /backup/, /cgi-bin/, /phpinfo.php, /actuator, /graphql, swagger.json and openapi.json.
4. Behavior matches automated reconnaissance before exploitation, credential theft or data exposure attempts.
5. After the configured threshold is reached the IP is added to the dynamic firewall layer and blocked at network level.

Matched Patterns

Observed Behavior

• Secrets hunting: attempts to access .env, .env.backup, /api/.env and .pypirc files.
• Backup discovery: HEAD/GET requests to /backup/ and old archive locations.
• Scanner camouflage: suspicious requests may use fake or misleading browser, AI crawler or search-engine User-Agent strings.
• Multi-site behavior: the same source network may probe many hosted domains with the same signature.

Why Are These IP Addresses Listed?

1. Requests include SQL injection signatures such as UNION SELECT and information_schema.
2. Attempts may target WordPress AJAX endpoints, plugin parameters or vulnerable query arguments.
3. Time-based SQL injection probes such as sleep(), benchmark() or waitfor delay indicate exploit automation.
4. Database extraction payloads such as load_file() or into outfile are high-risk compromise indicators.
5. The IP is blocked before repeated SQLi attempts can continue against hosted websites.

Matched Patterns

Observed Behavior

• Database enumeration payloads attempting to read table and user information.
• Blind/time-based probes designed to detect injectable parameters.
• Plugin or endpoint probing where the scanner does not know whether the target software exists.
• High-risk SQL payloads that have no normal visitor use case.

Why Are These IP Addresses Listed?

1. Suspicious or unwanted User-Agent.
2. Behavior typical of scraping or mass crawling activity.
3. Unnecessary load on Apache, PHP-FPM, Redis and databases.
4. May crawl large portions of websites without real user value.
5. Blocking preserves resources for legitimate visitors.

Why Are These IP Addresses Listed?

1. Large numbers of HTTP requests within a short period of time.
2. Behavior that can exhaust Apache and PHP worker resources.
3. Commonly observed with aggressive crawlers and automated tools.
4. Protects WooCommerce and WordPress websites from unnecessary load.
5. The IP address is blocked before it can create a prolonged load spike.

Why Are These IP Addresses Listed?

1. The request does not contain a User-Agent header.
2. This is often a sign of a curl/wget script, scanner or bot.
3. Legitimate browsers almost always send a User-Agent header.
4. These requests are often an early stage of probing or automated reconnaissance.
5. Blocking reduces background noise and unwanted traffic to websites.

Why Are These IP Addresses Listed?

1. Repeated requests targeting xmlrpc.php.
2. Often used for brute-force attacks and credential stuffing.
3. Can be used for amplification attacks and resource abuse.
4. It is not normal for a single external IP to aggressively target XML-RPC.
5. Blocking protects login systems and PHP-FPM processes.

Why Are These IP Addresses Listed?

1. Suspicious WordPress endpoints or login patterns.
2. Attempts to probe plugins and themes.
3. Requests typical of automated WordPress attack kits.
4. Behavior that does not resemble a legitimate visitor.
5. Blocking reduces the risk of brute-force attacks and vulnerability scanning.

Why Are These IP Addresses Listed?

1. Repeated failed SSH login attempts.
2. Brute-force attempts against system accounts.
3. Often originates from botnets or cloud VPS infrastructure.
4. SSH is a critical administrative access point to the server.
5. Blocking reduces the risk of root or server access compromise.

Why Are These IP Addresses Listed?

1. Failed SMTP authentication attempts.
2. Attempts at relay probing or mail abuse.
3. Behavior typical of mail brute-force tools.
4. Protects the reputation of the mail server.
5. Blocking protects domains from spam and abuse risks.