Anonymous
2026-09-08 02:21:16
(3 weeks ago)
Attack detected: 95.85.238.18 [2026-09-08]
Categories: 21
--- wp2shell/batch exploit (84 hits) ---
9 ...
show more
Attack detected: 95.85.238.18 [2026-09-08]
Categories: 21
--- wp2shell/batch exploit (84 hits) ---
95.85.238.18 - - [04/Aug/2026:13:40:28 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 5194 "-" "wp2shell_v2"
95.85.238.18 - - [04/Aug/2026:13:40:29 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 1003 "-" "wp2shell_v2"
95.85.238.18 - - [04/Aug/2026:13:40:29 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 5194 "-" "wp2shell_v2"
95.85.238.18 - - [04/Aug/2026:13:40:29 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 1003 "-" "wp2shell_v2"
95.85.238.18 - - [04/Aug/2026:13:40:30 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 5193 "-" "wp2shell_v2"
show less
Web App Attack
๐ฎ๐ณ
evicky2002
2026-08-26 07:31:11
(1 month ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
Anonymous
2026-08-25 09:27:52
(1 month ago)
Scanner hitting /plugins/editors/jce/jce.xml on () โ aaguard
Brute-Force
Port Scan
Anonymous
2026-08-24 02:16:31
(1 month ago)
Attack detected: 95.85.238.18 [2026-08-24]
Categories: 21
--- wp2shell/batch exploit (84 hits) ---
9 ...
show more
Attack detected: 95.85.238.18 [2026-08-24]
Categories: 21
--- wp2shell/batch exploit (84 hits) ---
95.85.238.18 - - [04/Aug/2026:13:40:28 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 5194 "-" "wp2shell_v2"
95.85.238.18 - - [04/Aug/2026:13:40:29 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 1003 "-" "wp2shell_v2"
95.85.238.18 - - [04/Aug/2026:13:40:29 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 5194 "-" "wp2shell_v2"
95.85.238.18 - - [04/Aug/2026:13:40:29 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 1003 "-" "wp2shell_v2"
95.85.238.18 - - [04/Aug/2026:13:40:30 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 5193 "-" "wp2shell_v2"
show less
Web App Attack
Anonymous
2026-08-23 13:47:27
(1 month ago)
Scanner hitting /plugins/editors/jce/jce.xml on () โ aaguard
Brute-Force
Port Scan
๐ฌ๐ง
andypiper
2026-08-23 01:02:51
(1 month ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
๐ซ๐ท
mail.avx.gr
2026-08-23 00:10:26
(1 month ago)
Plesk Fail2Ban jail: recidive-abuseipdb. Evidence: 2026-08-07 15:55:06,636 fail2ban.actions [5319]: ...
show more
Plesk Fail2Ban jail: recidive-abuseipdb. Evidence: 2026-08-07 15:55:06,636 fail2ban.actions [5319]: NOTICE [Plesk-WebScanners] Ban 95.85.238.18 2026-08-11 13:39:42,939 fail2ban.actions [5319]: NOTICE [Plesk-WebScanners] Ban 95.85.238.18 2026-08-13 07:37:14,633 fail2ban.actions [5319]: NOTICE [Plesk-WebScanners] Ban 95.85.238.18 2026-08-13 07:37:15,209 fail2ban.actions [5319]: NOTICE [recidive-unknown] Ban 95.85.238.18
show less
Hacking
๐ฌ๐ท
mail.avx.gr
2026-08-21 17:35:18
(1 month ago)
Plesk Fail2Ban jail: recidive-abuseipdb. Evidence: 2026-08-07 15:55:06,636 fail2ban.actions [5319]: ...
show more
Plesk Fail2Ban jail: recidive-abuseipdb. Evidence: 2026-08-07 15:55:06,636 fail2ban.actions [5319]: NOTICE [Plesk-WebScanners] Ban 95.85.238.18 2026-08-11 13:39:42,939 fail2ban.actions [5319]: NOTICE [Plesk-WebScanners] Ban 95.85.238.18 2026-08-13 07:37:14,633 fail2ban.actions [5319]: NOTICE [Plesk-WebScanners] Ban 95.85.238.18 2026-08-13 07:37:15,209 fail2ban.actions [5319]: NOTICE [recidive-unknown] Ban 95.85.238.18
show less
Hacking
๐จ๐ญ
lufi
2026-08-18 14:30:37
(1 month ago)
2026-08-18T16:29:39+02:00 lufischer04 ids442 2026-08-14 00:49:38 95.85.238.18: blacklistedPath: /med ...
show more
2026-08-18T16:29:39+02:00 lufischer04 ids442 2026-08-14 00:49:38 95.85.238.18: blacklistedPath: /media/system/js/core.js
...
show less
Web Spam
Brute-Force
Hacking
Web App Attack
๐ณ๐ฑ
JCB
2026-08-16 16:25:00
(1 month ago)
95.85.238.18 - - [15/Aug/2026:21:21:00 +0300] "GET /administrator/components/com_jce/ HTTP/1.1" 404 ...
show more
95.85.238.18 - - [15/Aug/2026:21:21:00 +0300] "GET /administrator/components/com_jce/ HTTP/1.1" 404 196 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1"
...
show less
Web App Attack
๐ซ๐ท
ELYAZ
2026-08-15 21:26:29
(1 month ago)
(y3) Failed access -byebye- from 95.85.238.18 (CZ/Czechia/-): (CF_ENABLE)
Hacking
๐ฉ๐ช
FeG Deutschland
2026-08-15 21:01:43
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 127
Exploited Host
Web App Attack
๐ฎ๐ช
Jim Keir
2026-08-15 16:29:44
(1 month ago)
2026-08-15 16:29:44 95.85.238.18 File scanning, blocking 95.85.238.18 for 5 minutes
Web App Attack
๐บ๐ธ
almazick
2026-08-15 14:30:54
(1 month ago)
Fail2Ban jail window on srv1.windowrepair.us banned 95.85.238.18 after 1 attempts
Bad Web Bot
Web App Attack
๐ฐ๐ท
MW
2026-08-15 14:19:25
(1 month ago)
95.85.238.18 - - [15/Aug/2026:23:19:22 +0900] "GET /plugins/editors/jce/jce.xml HTTP/1.1" 404 5825 " ...
show more
95.85.238.18 - - [15/Aug/2026:23:19:22 +0900] "GET /plugins/editors/jce/jce.xml HTTP/1.1" 404 5825 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
95.85.238.18 - - [15/Aug/2026:23:19:24 +0900] "GET /administrator/components/com_jce/ HTTP/1.1" 404 513 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15"
95.85.238.18 - - [15/Aug/2026:23:19:24 +0900] "GET /media/system/js/core.js HTTP/1.1" 404 513 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1"
show less
Bad Web Bot
Web App Attack