159.65.158.192 — observed request history

← Back to my full IP blocklist

I blocked 159.65.158.192. Here are the request paths I found in my retained logs.

10 distinct paths · 10 matching log entries

First retained entry: 2026-10-22T15:35:38.056Z. Last retained entry: 2026-10-22T15:35:48.281Z. All timestamps are UTC.

Where it showed up

• doomo / supaknock-website — 10 log entries

Observed endpoints

Each line shows the path, HTTP method, recorded status codes, and log-entry count. Counts may include duplicate logging and are not necessarily unique requests. “Unknown” means the status was not captured in the normalized entry.

/ | GET | 200 | 1
/2018/wp-includes/wlwmanifest.xml | GET | 404 | 1
/blog/wp-includes/wlwmanifest.xml | GET | 404 | 1
/cms/wp-includes/wlwmanifest.xml | GET | 404 | 1
/shop/wp-includes/wlwmanifest.xml | GET | 404 | 1
/test/wp-includes/wlwmanifest.xml | GET | 404 | 1
/wordpress/wp-includes/wlwmanifest.xml | GET | 404 | 1
/wp/wp-includes/wlwmanifest.xml | GET | 404 | 1
/wp2/wp-includes/wlwmanifest.xml | GET | 404 | 1
/xmlrpc.php | GET | 404 | 1

About this record

I pulled this list from retained Vitals logs on October 25, 2026 (UTC), with coverage back to October 22. This is the history I can still verify, not a complete lifetime history. Query strings and fragments are omitted. A response code alone does not prove that credentials were exposed.

Source attribution recorded by Vitals: forwarded_unverified. Reported or forwarded addresses are not independently verified identities. An IP can be shared or reassigned.

Back to my full IP blocklist. I’ll keep this updated as I find more.