← appsec.fyi

WordPress Honeypot Report

Updated 2026-06-01 12:03 EDT · Collecting credentials, IPs, and user agents from WordPress scanners

41,331
Total Hits
728
Unique IPs
36,503
Cred Attempts

First hit: 2026-04-13T16:39:47 · Last hit: 2026-06-01T12:01:55

Hits by Day (Last 30 Days)

2026-06-01
244
2026-05-31
1811
2026-05-30
1411
2026-05-29
773
2026-05-28
1889
2026-05-27
421
2026-05-26
158
2026-05-25
1391
2026-05-24
1478
2026-05-23
421
2026-05-22
405
2026-05-21
2650
2026-05-20
412
2026-05-19
1307
2026-05-18
413
2026-05-17
1066
2026-05-16
268
2026-05-15
387
2026-05-14
796
2026-05-13
1281
2026-05-12
156
2026-05-11
129
2026-05-10
81
2026-05-09
150
2026-05-08
1337
2026-05-07
1516
2026-05-06
76
2026-05-05
1275
2026-05-04
3669
2026-05-03
3538

Hits by Hour (Eastern)

00
1819
01
2070
02
2605
03
3781
04
2717
05
504
06
1456
07
897
08
2528
09
2149
10
1163
11
770
12
2121
13
1888
14
2088
15
1807
16
278
17
1016
18
1651
19
1264
20
1684
21
1492
22
1701
23
1882

Top Usernames

UsernameCount
wp.getUsersBlogs25761
19226
lukas732
admin298
admin@wordpress.com30
322
222
root19
administrator1@wordpress.com18
administrator12
appsec.fyi10
appsec10
Lara9
johnelouter6
inforena6
wp.getUsers5
backupsystems5
allen-yin5
yoyo-xu4
wordpressauto4
web@fingersduke.com4
wadminw4
44
yanz@1234573
xtw18387f8163

Top Passwords

PasswordCount
admin20601
marketingfab3532cf38134
appsec.fyi3017
tobias-vale1188
appsec1049
lukas831
12345614
password12
1234567812
r007p455w0rd9
63a9f0ea79
!r007p455w0rd!9
password1238
admin1238
todaykiller337@A7
r007p4S5w0rd7
DH!bYsRn6573$3uk7
rastap455w0rd6
r007pas5w0rd6
g4a5J8fWeSfRvNMT6
fZgfj64ffs!32gggfAS6
admin@https://log.topsites.cc6
Jane3922166
$KH3WSERDfe4yfsfg$6
jiohotstar5

Top Credential Pairs

UsernamePasswordCount
wp.getUsersBlogsadmin15604
wp.getUsersBlogsmarketingfab3532cf38134
1admin4988
1appsec.fyi3014
wp.getUsersBlogstobias-vale1188
1appsec1046
wp.getUsersBlogslukas830
wp.getUsersBlogsjiohotstar5
ACHObTJGpWvVx3G8WKk3
Administrarot63a9f0ea73
BearyIronWay9!#3
CarezaikeEnjf!p1t23GJ3
EricHocklySureweb0063
GuaUserWa3Arqfosg1@1s2.3@3
Lara7xTp4Lw3
LaraJane3922163
Laraadmin@https://log.topsites.cc3
User$ri$htiR@j@t@20193
ad_ddddinxsacreed@3
admin https://log.topsites.cc3
admin!@#$%^3
admin!@#admin3
admin!QAZxsw23
admin1234563
admin123456!@#3

Top Countries

CountryUnique IPs
United States191
Germany64
India51
Canada46
France41
Brazil36
Singapore35
Vietnam30
United Kingdom21
Spain17
Japan15
Netherlands14
Finland10
Australia10
The Netherlands9

Top IPs

IPLocationHitsCred Attempts
206.189.158.221Singapore, Singapore116271
194.26.192.20Lelystad, Netherlands20061
217.79.116.155Sydney, Australia18601
140.245.121.218Singapore, Singapore15683
34.124.194.173Singapore, Singapore14561
134.209.100.109Singapore, Singapore11921
34.48.121.4Washington, United States11501
136.107.18.37Washington, United States11311
35.231.4.211North Charleston, United States10441
137.184.130.181North Bergen, United States8331
162.243.42.117Secaucus, United States8331
192.241.244.4Secaucus, United States8331
186.22.17.80Buenos Aires, Argentina6311
91.224.92.35Vilnius, Lithuania413186
136.158.123.19Tarlac City, Philippines3791
146.190.254.54Toronto, Canada3631
177.34.168.80São Carlos, Brazil3501
161.118.192.143Singapore, Singapore24667
161.118.234.191Singapore, Singapore24667
178.73.101.128Jeddah, Saudi Arabia2321
189.178.81.66Guadalajara, Mexico2211
172.202.92.73Des Moines, United States1520
104.28.165.181Vantaa, Finland1501
122.163.233.68Lucknow, India1501
122.183.32.210Pune, India1501

Top Paths

PathHits
/xmlrpc.php34903
/wp-login.php2565
/wp-json/wp/v2/users/me581
/wp-content/plugins/hellopress/wp_filemanager.php108
/wp-json/wp/v2/users77
/wp-content/admin.php77
/wp-content/uploads/40
/wp-content/themes/index.php37
/wp-content/index.php37
/wp-admin/js/index.php37
/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings32
/wp-admin/js/30
/wp-includes/Text/Diff/Engine/about.php29
/wp-admin/css/29
/wp-json/wp/v2/users/27
/wp-json/oembed/1.0/embed?url=https://appsec.fyi/27
/wp-includes/wlwmanifest.xml27
/wp-content/themes/admin.php27
/wp-admin/css/bolt.php26
/wp-includes/Requests/25
/wp-content/plugins/admin.php25
/wp-includes/l10n/23
/wp-includes/js/jquery/23
/wp-includes/css/dist/23
/wp-content/plugins/index.php23

Top User Agents

User AgentHits
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)…10952
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)…9328
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)…3436
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)…2499
WordPress.com; https://wordpress.com787
Jetpack by WordPress.com772
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)…578
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)…363
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)…192
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/5…127
Mozilla/5.0 (Macintosh; Intel Mac OS X 11_7_10) AppleWebKit/537.36 (KHTML, like …103
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chro…100
Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.…98
Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) C…87
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.082

Methods

MethodCount
POST36503
GET4809
HEAD19