your Server/Customer with the IP: *80.71.227.150* (498849.vm.spacecore.network) has attacked one of our servers/partners. The attackers used the method/service: *badbot* on: *Mon, 19 Oct 2026 22:44:45 +0200*. The time listed is from the server-time of the Blocklist-user who submitted the report. The attack was reported to the Blocklist.de-System on: *Mon, 19 Oct 2026 22:44:49 +0200* !!! Do not answer to this Mail! Use support@ or contact-form for Questions (no resolve-messages, no updates....) !!! The IP has been automatically blocked for a period of time. For an IP to be blocked, it needs to have made several failed logins (ssh, imap....), tried to log in for an "invalid user", or have triggered several 5xx-Error-Codes (eg. Blacklist on email...), all during a short period of time. The Server-Owner configures the number of failed attempts, and the time period they have to occur in, in order to trigger a ban and report. Blocklist has no control over these settings. The IP has send a SPAM-Comment on a Honeypot-Forum or Honeypot-Wiki with URLs to e.g. buy viagra or link to other spamvertised sites. He used xrumer or other Tools or had a false configured mod_rewrite/mod_proxy who is abused: http://blog.blocklist.de/2011/03/14/erlauterung-der-einzelnen-dienste-badbots-apacheddos-postfix/#badbots If the IP is a Tor-Server: https://blog.blocklist.de/tor-server-owner/ Please check the machine behind the IP 80.71.227.150 (498849.vm.spacecore.network) and fix the problem. To search for AS-Number/IPs that you control, to see if any others have been infected/blocked, please go to: https://www.blocklist.de/en/search.html?as=198037
Source IP: 80.71.227.150 Source ASN / Org: AS198037 / SPACECORE SOLUTION LTD Source type: DC Country: NL Target: https://radiosoftware.online Time window: First seen UTC: 2026-10-20T14:57:30Z Last seen UTC: 2026-10-20T14:57:33Z Observed activity: The source IP requested non-public, administrative, backup, configuration, or otherwise sensitive URLs on our web server. These requests appear to be automated probing and are not authorized. Qualified threat-evidence hits in this monitoring window: 112 Explicit signature hits: 112 Unauthorized unexpected POST hits: 0 HTTP 403 responses among threat evidence: 0 Unique threat-evidence URLs in this monitoring window: 16 Requested URLs: - /2019/wp-includes/wlwmanifest.xml (7 hit(s)) - /2020/wp-includes/wlwmanifest.xml (7 hit(s)) - /blog/wp-includes/wlwmanifest.xml (7 hit(s)) - /cms/wp-includes/wlwmanifest.xml (7 hit(s)) - /news/wp-includes/wlwmanifest.xml (7 hit(s)) - /shop/wp-includes/wlwmanifest.xml (7 hit(s)) - /site/wp-includes/wlwmanifest.xml (7 hit(s)) - /sito/wp-includes/wlwmanifest.xml (7 hit(s)) - /test/wp-includes/wlwmanifest.xml (7 hit(s)) - /web/wp-includes/wlwmanifest.xml (7 hit(s)) - /website/wp-includes/wlwmanifest.xml (7 hit(s)) - /wordpress/wp-includes/wlwmanifest.xml (7 hit(s)) - /wp-includes/wlwmanifest.xml (7 hit(s)) - /wp/wp-includes/wlwmanifest.xml (7 hit(s)) - /wp1/wp-includes/wlwmanifest.xml (7 hit(s)) - /wp2/wp-includes/wlwmanifest.xml (7 hit(s)) Sample log rows: 2026-10-20T14:57:30Z GET 404 /wp-includes/wlwmanifest.xml UA=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36 2026-10-20T14:57:30Z GET 404 /wp-includes/wlwmanifest.xml UA=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36 2026-10-20T14:57:30Z GET 404 /wp-includes/wlwmanifest.xml UA=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36 2026-10-20T14:57:30Z GET 404 /wp-includes/wlwmanifest.xml UA=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36 2026-10-20T14:57:30Z GET 404 /wp-includes/wlwmanifest.xml UA=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36 2026-10-20T14:57:30Z GET 404 /wp-includes/wlwmanifest.xml UA=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36 2026-10-20T14:57:31Z GET 404 /blog/wp-includes/wlwmanifest.xml UA=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36 2026-10-20T14:57:31Z GET 404 /wp-includes/wlwmanifest.xml UA=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36 2026-10-20T14:57:31Z GET 404 /blog/wp-includes/wlwmanifest.xml UA=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36 2026-10-20T14:57:31Z GET 404 /blog/wp-includes/wlwmanifest.xml UA=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36 Please investigate and take appropriate action according to your network abuse / acceptable use policy.
