Threat LevelHIGH53/1002 rule types

3 incidents on record · 2 rule types · confirmed on global blocklist · persistent 19-day campaign · seen 1h ago

PTR	N/A
Org / ASN	Vultr Holdings, LLC
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse
Timezone	Europe/Berlin

Attack Analysis

Listed on 1 threat-intelligence blocklist

FireHOL level2 — FireHOL level2 lists addresses seen attacking in the last 48 hours across many sensors. It is large and volatile: addresses enter and leave quickly, so on its own this is weaker, recent-activity evidence.

Only short-lived or context lists match, so this is weak evidence on its own.

Plugin/Theme Version Fingerprinting Probe

This IP requested an installed plugin or theme's readme.txt/changelog.txt directly over HTTP — the file's "Stable tag:" line names the exact installed version, which an attacker cross-references against known CVEs for that version before firing the real exploit. WordPress.org's own tooling reads this file server-side, never over HTTP.

Reports (3)

Date	Severity	Description
29 Sep 2026 - 23:08	low	Query Guard — Path Plugin Theme Readme Probe
11 Sep 2026 - 03:44	low	FireHOL level2 (48h recent-attacker feed, large & volatile)
10 Sep 2026 - 18:21	low	FireHOL level2 (48h recent-attacker feed, large & volatile)

Report for IP: 45.76.92.236

Attack Analysis

Reports (3)