This IP address has been reported a total of
1,599
times from
487 distinct
sources.
169.40.142.224 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
{"level":"info","ts":"2026-10-30T19:43:21Z","logger":"http.log.access.log9","msg":"handled request", ...
show more{"level":"info","ts":"2026-10-30T19:43:21Z","logger":"http.log.access.log9","msg":"handled request","request":{"remote_ip":"169.40.142.224","remote_port":"51982","client_ip":"169.40.142.224","proto":"HTTP/1.1","method":"GET","host":"botwork.se","uri":"/wp-config.php.bak","headers":{"Accept":["text/html, */*"],"Connection":["close"],"Accept-Encoding":["identity"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"botwork.se","ech":false}},"bytes_read":0,"user_id":"","duration":0.642305879,"size":106969,"status":404,"resp_headers":{"Referrer-Policy":["strict-origin-when-cross-origin"],"Strict-Transport-Security":["max-age=31536000"],"X-Frame-Options":["SAMEORIGIN"],"Vary":["Accept"],"Link":["<https://botwork.se/.well-known/api-catalog>; rel=\"api-catalog\"; type=\"application/linkset+json\", <https://botwork.se/wp-json/webmcp-br
...
show less
Web attack blocked by WAF: POST /, POST /index.php, POST /wp-json/batch/v1 (WordPress wp2shell REST ...
show moreWeb attack blocked by WAF: POST /, POST /index.php, POST /wp-json/batch/v1 (WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)).
[30/Oct/2026:20:18:13 +0300] "POST /?rest_route=/batch/v1 HTTP/1.1" UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)" -> WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)
[30/Oct/2026:20:18:14 +0300] "POST /index.php?rest_route=/batch/v1 HTTP/1.1" UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)" -> WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)
[30/Oct/2026:20:18:14 +0300] "POST /wp-json/batch/v1 HTTP/1.1" UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)" -> WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)
show less
automated vulnerability scanning against a customer-facing web application. Window (UTC): 2026-10-30 ...
show moreautomated vulnerability scanning against a customer-facing web application. Window (UTC): 2026-10-30T14:57:04.645Z to 2026-10-30T14:57:06.809Z. Events: 3. Paths: /pathscan-23b3fcced454-nope.env , /.env.txt , /.env.save.
show less
Web App Attack
Hacking
Anonymous
[ns31.kdns.gr] httpd-suspicious-path: sites=www.xatzitriantafulloubros-packaging.gr; logs=/var/log/h ...
show more[ns31.kdns.gr] httpd-suspicious-path: sites=www.xatzitriantafulloubros-packaging.gr; logs=/var/log/httpd/domains/xatzitriantafulloubros-packaging.gr.log; samples=/api/session/properties
show less