Need help?
GD Sentinel
Live monitoring

Behavioral Threat Detection

Real-time malicious activity detection across your WordPress hosting infrastructure

Sites Monitored
12,847
↓ 23 offline
Active Threats
7
↑ 3 new today
Anomalies Detected
34
Under investigation
Auto-Contained
156
↓ 12% this week
High-Risk Sites
SiteRisk LevelOutbound/hrCPUFlagged File
petstore-online.com
Hosting ID: wp-8847
Critical127,43194%helper.php
luxurywatches.shop
Hosting ID: wp-2293
Critical89,22387%class-loader.php
healthyfoodtips.net
Hosting ID: wp-5512
Warning23,84772%functions.php
localcoffeeroasters.com
Hosting ID: wp-1104
Warning18,39268%widget.php
fitnessgear-pro.com
Hosting ID: wp-9921
Safe1,24723%
petstore-online.com
Detected 23 minutes ago
AI Analysis
Claude Analysis

This site contains obfuscated PHP code making 127K+ hourly requests to a known cryptomining pool. The malicious payload was injected via a compromised Contact Form 7 update 3 days ago.

Threat Metrics
Outbound requests/hour127,431
Destinationpool.crypto-mine.cc
CPU utilization94%
File modifiedJan 11, 2026 04:23
Malicious Code
/wp-content/plugins/contact-form-7/includes/helper.php
// Injected payload - Line 847
if(isset($_GET['cf7_cache'])) {
  $d = base64_decode('ZXZhbChnemluZmxhdGUoYmFz...');
  eval(gzinflate($d));
}
// Connects to pool.crypto-mine.cc:3333
Activity Timeline
Today 14:37
Anomaly detected by behavior engine
Today 14:38
AI analysis completed
Jan 11, 04:23
helper.php modified
Jan 11, 04:20
Plugin update: Contact Form 7

Incident History

Complete audit trail of detected threats and response actions

All Incidents
Incident IDSiteThreat TypeStatusDetectedResponse Time
INC-2026-0147
petstore-online.com
CryptominingActiveJan 14, 14:37
INC-2026-0146
luxurywatches.shop
Spam RelayActiveJan 14, 13:22
INC-2026-0145
healthyfoodtips.net
DDoS BotnetInvestigatingJan 14, 11:45
INC-2026-0144
gardensupplies.co
CryptominingContainedJan 13, 22:184m 23s
INC-2026-0143
techblog-daily.com
Data ExfiltrationResolvedJan 13, 16:422m 11s
Showing 5 of 156 incidents

Threat Intelligence

Known malicious endpoints, attack patterns, and behavioral signatures

Blocked Endpoints
2,847
↑ 127 this week
Attack Patterns
342
Last updated 2h ago
Obfuscation Signatures
1,204
↑ 34 new patterns
Community Reports
89
Pending review
Malicious Endpoints
EndpointCategoryHits (24h)First Seen
pool.crypto-mine.ccCryptomining47,832Dec 2, 2025
smtp-relay.spam-net.ruSpam Relay23,441Jan 8, 2026
c2.botnet.ccC2 Server12,847Jan 10, 2026
Detection Patterns
CODE OBFUSCATION
eval(base64_decode(...))
eval(gzinflate(str_rot13(...)))
preg_replace('/.*/e', ...)
BEHAVIORAL THRESHOLDS
Outbound > 5,000/hrWarning
Outbound > 50,000/hrCritical
Connection to known C2Critical

Settings

Configure detection thresholds, notifications, and automated responses

Detection Thresholds
Outbound Request Warning
Trigger warning at this threshold
req/hr
Outbound Request Critical
Trigger critical alert
req/hr
CPU Spike Threshold
CPU % that triggers investigation
%
Automated Responses
Auto-Quarantine Critical Threats
Automatically quarantine confirmed threats
Auto-Block Malicious IPs
Block known malicious endpoints
Auto-Notify Customer
Send notification when threat detected
Notifications
Email Alerts
Send email for critical threats
Slack Integration
Post alerts to Slack channel
Alert Recipients
Email addresses for alerts
API Configuration
Claude API Key
For AI-powered threat analysis