Verdict Coordinated WordPress reconnaissance and exploitation scan targeting common administrative, configuration, and malware-related paths. Activity included probing for sensitive configuration files, known malicious webshell filenames, WordPress login interfaces, AJAX handlers, and XML-RPC endpoints. Multiple requests presented inconsistent browser fingerprints, rotating between Chrome, Firefox, and Safari on different operating systems despite originating from the same automated infrastructure. This behavior is consistent with scripted scanning rather than human browsing. No compromise was observed. Probe requests were consistently denied with HTTP 409 and 406 responses. Several legitimate directories returned HTTP 200 responses, indicating directory indexing remains exposed. ## Source Systems | IP Address | Network | Hits | Observed Activity | Assessment | |------------|---------|------|-------------------|------------| | 20.24.222.184 | Microsoft Azure | ~20 | Enumeration of `/wp-content/`, `/wp-admin/`, `/wp-includes/`; webshell and backdoor filename probes | Malicious automated scanner | | 52.242.132.37 | Microsoft Azure | ~14 | Probing for `wp-good.php`, `wmc.php`, `wp-config.php`, `xmlrpc.php` and related targets | Malicious automated scanner | | 159.13.55.134 | Unattributed | ~6 | Login, admin-ajax, SSO, REST API, and batch endpoint probing | Malicious automated scanner | | 45.131.193.29 | Hosting provider range | 1 | Direct probe of `wp-login.php` | Credential attack reconnaissance | | 165.22.255.246 | DigitalOcean | ~3 | Legacy WordPress path and version-discovery scanning | WordPress reconnaissance scanner | ## Objectives Observed ### 1. Configuration Theft Attempts to access `wp-config.php`, the primary WordPress configuration file containing database connection details and security settings. ### 2. Existing Backdoor Discovery Requests for files including: - `wp-good.php` - `vx.php` - `kir.php` - `bypass.php` - `wmc.php` These filenames are commonly associated with previously deployed webshells and malicious persistence mechanisms. The requests indicate a search for an already-compromised host rather than an initial compromise attempt. ### 3. Remote Access and Abuse Vectors Requests targeting: - `xmlrpc.php` - `admin-ajax.php` - REST API endpoints These locations are frequently assessed for authentication abuse, brute-force activity, SSRF opportunities, and vulnerable plugin functionality. ### 4. Authentication Testing Direct access attempts against `wp-login.php` indicate credential validation and account enumeration activity. ## Impact Assessment - No successful access observed. - No successful execution observed. - No evidence of authentication bypass. - No evidence of file disclosure. - No evidence of code execution. - Defensive controls successfully intercepted all hostile probes. ## Recommended Response ### 1. Block Identified Sources Apply deny rules at the firewall, reverse proxy, CDN, or WAF level for: - 20.24.222.184 - 52.242.132.37 - 159.13.55.134 - 45.131.193.29 - 165.22.255.246 ### 2. Restrict XML-RPC Disable or strictly limit access to `xmlrpc.php` if not operationally required. ### 3. Eliminate Directory Indexing Directory listings were accessible under locations including cache and JavaScript asset directories. Disable indexing: ```apache Options -Indexes ``` ### 4. Harden Authentication - Rate-limit access to `wp-login.php` - Enforce MFA where available - Restrict administrative access by source network where feasible - Monitor failed authentication attempts ### 5. Report Abuse Submit supporting log evidence to: - Microsoft Azure Abuse Reporting - abuse@digitalocean.com - AbuseIPDB ### 6. Monitor Follow-On Activity Automated WordPress scanners routinely rotate infrastructure. Monitor adjacent IP ranges and repeat requests for identical filenames, paths, and user-agent patterns. ## Conclusion The activity was a hostile automated WordPress scanning campaign focused on locating exposed configuration files, previously deployed webshells, administrative interfaces, and authentication surfaces. All observed exploitation attempts were denied by existing protections. The primary residual issue identified is exposed directory indexing, which should be disabled to reduce information disclosure. Existing WAF controls successfully prevented all observed attack attempts. Fiveo1 PO Box 312786 Avalon, California 90704 Evan Winter, District 69