Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell: two critical PHP flaws affect most WordPress hosting. See if your site is affectedFlagged by our vulnerability database: PHP2Shell, two critical PHP flaws. DetailsFlagged: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Live, updated every minute

Who's trying to break into our site (it's going terribly)

Every bot that comes sniffing around for a way into this website: WordPress logins, password files, source code, database backups. None of those exist here, so every one of them leaves with nothing. Almost all of it is automated, the same bots hitting every site on the internet. Yours included.

2,042attempts logged since October 6, 2026
102today
922in the last 7 days
0times they got anything (lol)

The daily clown parade

Attempts per day, last 30 days. Every bar is a bot that left with nothing.

What they were hoping to find

  • WordPress1,624

    WordPress login, installer, user list and xmlrpc. This site doesn't run WordPress.

  • .env files227

    Configuration files that hold passwords and API keys when a site leaves them public.

  • Source code154

    A /.git folder left on a live site lets anyone download the whole codebase.

  • Old server software19

    Router admin pages, cgi-bin and debug endpoints from other platforms.

  • PHP scripts14

    Requests for PHP files. There are none on this site.

  • Cloud and SSH keys4

    AWS credentials, SSH keys and editor files that can hold saved logins.

Most wanted (and never found)

The URLs they keep begging for every single day, like it'll work this time.

  1. /wp-admin/install.php1,241
  2. /.env153
  3. /.git/HEAD139
  4. /wp-json/wp/v2/users138
  5. /wp-json/wc/store/v1/products137
  6. /wp-login.php54
  7. /xmlrpc.php34
  8. /.git/config15
  9. /wp-admin8
  10. /getcmd6
  11. /_profiler/open6
  12. /.env.production3

Live from the front door, they're still knocking

live

The latest attempts, newest first. 1,499 of 2,042 never got past the firewall; the rest got a 404.

  • 6:00 PMGET /wp-json/wp/v2/usersWordPressNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 6:00 PMGET /wp-json/wc/store/v1/productsWordPressNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 6:00 PMGET /.git/HEADSource codeNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 6:00 PMGET /.env.env filesNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 5:41 PMGET /.env.env filesNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 5:40 PMGET /wp-admin/install.phpWordPressNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 5:21 PMGET /.env.env filesNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 5:21 PMGET /.env.env filesNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 5:15 PMGET /.env.env filesNothing here (404)curlcame in through Washington, D.C.
  • 5:08 PMGET /wp-admin/install.phpWordPressNothing here (404)http:came in through Frankfurt
  • 4:13 PMGET /.env.production.env filesNothing here (404)curl🇺🇸 United States
  • 4:13 PMGET /wp-json/wp/v2/usersWordPressBlocked at the firewallcurl🇺🇸 United States
  • 4:13 PMGET /xmlrpc.phpWordPressBlocked at the firewallcurl🇺🇸 United States
  • 4:13 PMGET /wp-login.phpWordPressBlocked at the firewallcurl🇺🇸 United States
  • 4:13 PMGET /.git/configSource codeNothing here (404)curl🇺🇸 United States
  • 4:13 PMGET /.git/HEADSource codeNothing here (404)curl🇺🇸 United States
  • 4:13 PMGET /.env.env filesNothing here (404)curl🇺🇸 United States
  • 4:00 PMGET /wp-json/wp/v2/usersWordPressBlocked at the firewallClaims to be a browser🇺🇸 United States
  • 4:00 PMGET /.env.env filesNothing here (404)Claims to be a browser🇺🇸 United States
  • 4:00 PMGET /wp-json/wc/store/v1/productsWordPressBlocked at the firewallClaims to be a browser🇺🇸 United States
  • 4:00 PMGET /.git/HEADSource codeNothing here (404)Claims to be a browser🇺🇸 United States
  • 3:00 PMGET /.git/HEADSource codeNothing here (404)Claims to be a browser🇺🇸 United States
  • 3:00 PMGET /wp-json/wc/store/v1/productsWordPressBlocked at the firewallClaims to be a browser🇺🇸 United States
  • 3:00 PMGET /.env.env filesNothing here (404)Claims to be a browser🇺🇸 United States
  • 3:00 PMGET /wp-json/wp/v2/usersWordPressBlocked at the firewallClaims to be a browser🇺🇸 United States
  • 2:42 PMGET /wp-admin/install.phpWordPressBlocked at the firewallhttp:🇩🇪 Germany
  • 2:00 PMGET /wp-json/wp/v2/usersWordPressBlocked at the firewallClaims to be a browser🇺🇸 United States
  • 2:00 PMGET /.env.env filesNothing here (404)Claims to be a browser🇺🇸 United States
  • 2:00 PMGET /.git/HEADSource codeNothing here (404)Claims to be a browser🇺🇸 United States
  • 2:00 PMGET /wp-json/wc/store/v1/productsWordPressBlocked at the firewallClaims to be a browser🇺🇸 United States
  • 1:14 PMGET /.env.env filesNothing here (404)Claims to be a browser🇺🇸 United States
  • 1:14 PMGET /wp-json/wc/store/v1/productsWordPressBlocked at the firewallClaims to be a browser🇺🇸 United States
  • 1:14 PMGET /wp-json/wp/v2/usersWordPressBlocked at the firewallClaims to be a browser🇺🇸 United States
  • 1:14 PMGET /.git/HEADSource codeNothing here (404)Claims to be a browser🇺🇸 United States
  • 1:00 PMGET /wp-json/wc/store/v1/productsWordPressBlocked at the firewallClaims to be a browser🇺🇸 United States
  • 1:00 PMGET /.env.env filesNothing here (404)Claims to be a browser🇺🇸 United States
  • 1:00 PMGET /.git/HEADSource codeNothing here (404)Claims to be a browser🇺🇸 United States
  • 1:00 PMGET /wp-json/wp/v2/usersWordPressBlocked at the firewallClaims to be a browser🇺🇸 United States
  • 12:39 PMGET /wp-admin/install.phpWordPressBlocked at the firewallhttp:🇩🇪 Germany
  • 12:00 PMGET /.env.env filesNothing here (404)Claims to be a browser🇺🇸 United States

Where they're knocking from

Country of the address, where we have it. Most of these are rented servers, not people.

  • 🇺🇸 United States596
  • 🇩🇪 Germany564
  • 🇸🇪 Sweden510
  • 🇳🇱 Netherlands145
  • 🇬🇧 United Kingdom84
  • 🇵🇱 Poland30
  • 🇯🇵 Japan24
  • 🇫🇷 France8
  • 🇧🇩 Bangladesh8
  • 🇮🇩 Indonesia7

Which door they tried to kick in

The data center that took the request, which is usually the one nearest the bot.

  • Frankfurt725
  • Washington, D.C.588
  • Stockholm542
  • London84
  • Singapore23
  • Osaka16
  • San Francisco14
  • Mumbai12
  • Paris12
  • Tokyo8

The same bots are knocking on your website right now. The difference is what answers. Check your site for free or book a security assessment.