Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Live, updated every minute

Who's trying to break into our site (it's going terribly)

Every bot that comes sniffing around for a way into this website: WordPress logins, password files, source code, database backups. None of those exist here, so every one of them leaves with nothing. Almost all of it is automated, the same bots hitting every site on the internet. Yours included.

2,372attempts logged since October 6, 2026
48today
921in the last 7 days
0times they got anything (lol)

The daily clown parade

Attempts per day, last 30 days. Every bar is a bot that left with nothing.

What they were hoping to find

  • WordPress1,800

    WordPress login, installer, user list and xmlrpc. This site doesn't run WordPress.

  • .env files303

    Configuration files that hold passwords and API keys when a site leaves them public.

  • Source code215

    A /.git folder left on a live site lets anyone download the whole codebase.

  • Old server software28

    Router admin pages, cgi-bin and debug endpoints from other platforms.

  • PHP scripts15

    Requests for PHP files. There are none on this site.

  • Databases and backups7

    phpMyAdmin, SQL dumps and backup archives.

  • Cloud and SSH keys4

    AWS credentials, SSH keys and editor files that can hold saved logins.

Most wanted (and never found)

The URLs they keep begging for every single day, like it'll work this time.

  1. /wp-admin/install.php1,272
  2. /.env215
  3. /.git/HEAD199
  4. /wp-json/wp/v2/users196
  5. /wp-json/wc/store/v1/products195
  6. /wp-login.php56
  7. /xmlrpc.php38
  8. /.git/config16
  9. /getcmd14
  10. /wp-admin8
  11. /guides/small-office-server-backup7
  12. /_profiler/open7

Live from the front door, they're still knocking

live

The latest attempts, newest first. 1,499 of 2,372 never got past the firewall; the rest got a 404.

  • 4:35 AMGET /wordpress-plugins/trinity-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 4:32 AMGET /wordpress-plugins/everest-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 4:00 AMGET /.git/HEADSource codeNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 4:00 AMGET /wp-json/wp/v2/usersWordPressNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 4:00 AMGET /wp-json/wc/store/v1/productsWordPressNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 4:00 AMGET /.env.env filesNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 3:57 AMGET /wordpress-plugins/everest-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 3:33 AMGET /wordpress-plugins/backup-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 3:30 AMGET /wordpress-plugins/sk-wp-settings-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 3:29 AMGET /wordpress-plugins/pcloud-wp-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 3:11 AMGET /wordpress-plugins/wp-db-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 3:00 AMGET /.env.env filesNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 3:00 AMGET /wp-json/wp/v2/usersWordPressNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 3:00 AMGET /wp-json/wc/store/v1/productsWordPressNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 3:00 AMGET /.git/HEADSource codeNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 2:50 AMGET /wp-admin/install.phpWordPressNothing here (404)http:came in through Frankfurt
  • 2:31 AMGET /wordpress-plugins/cyan-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 2:31 AMGET /wordpress-plugins/norvis-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 2:31 AMGET /wordpress-plugins/worry-proof-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 2:30 AMGET /wordpress-plugins/db-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 2:11 AMGET /wordpress-plugins/boldgrid-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 2:00 AMGET /.env.env filesNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 2:00 AMGET /.git/HEADSource codeNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 2:00 AMGET /wp-json/wc/store/v1/productsWordPressNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 2:00 AMGET /wp-json/wp/v2/usersWordPressNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 1:56 AMGET /wordpress-plugins/simple-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 1:45 AMGET /wordpress-plugins/everest-backupWordPressNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 1:37 AMGET /wordpress-plugins/xm-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 1:29 AMGET /wordpress-plugins/everest-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 1:28 AMGET /wordpress-plugins/wordpress-sql-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 1:27 AMGET /.env.env filesNothing here (404)Claims to be a browsercame in through Stockholm
  • 1:27 AMGET /.env.example.env filesNothing here (404)Claims to be a browsercame in through Stockholm
  • 1:19 AMGET /wordpress-plugins/database-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 1:14 AMGET /xmlrpc.phpWordPressNothing here (404)Claims to be a browsercame in through Frankfurt
  • 1:05 AMGET /wordpress-plugins/backup-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 1:05 AMGET /wordpress-plugins/wp-database-backupWordPressNothing here (404)Claims to be a browsercame in through Cleveland
  • 1:01 AMGET /wordpress-plugins/everest-backupWordPressNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 1:00 AMGET /wp-json/wc/store/v1/productsWordPressNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 1:00 AMGET /.env.env filesNothing here (404)Claims to be a browsercame in through Washington, D.C.
  • 1:00 AMGET /.git/HEADSource codeNothing here (404)Claims to be a browsercame in through Washington, D.C.

Where they're knocking from

Country of the address, where we have it. Most of these are rented servers, not people.

  • 🇺🇸 United States596
  • 🇩🇪 Germany564
  • 🇸🇪 Sweden510
  • 🇳🇱 Netherlands145
  • 🇬🇧 United Kingdom84
  • 🇵🇱 Poland30
  • 🇯🇵 Japan24
  • 🇫🇷 France8
  • 🇧🇩 Bangladesh8
  • 🇮🇩 Indonesia7

Which door they tried to kick in

The data center that took the request, which is usually the one nearest the bot.

  • Washington, D.C.844
  • Frankfurt745
  • Stockholm557
  • London84
  • Cleveland29
  • Singapore25
  • Paris19
  • Osaka16
  • San Francisco14
  • Mumbai13

The same bots are knocking on your website right now. The difference is what answers. Check your site for free or book a security assessment.