Back to cases

Live public case

Opportunistic scan

Last activity Aug 25, 5:04:23 AM PDT

mediumNot required

Evidence-grounded assessment

Not required

This is a true-positive opportunistic reconnaissance event, not a confirmed compromise. The incident’s cited sequence records rapid GET enumeration of PHP/WordPress probe paths against target privatekind; inspected examples produced only HTTP 301 redirects or 404 responses (HTTP [redacted], [redacted], [redacted], [redacted]). The detector’s aggregate is 39 requests across 20 unique probe paths in about 4.2 seconds, with all 39 classified as redirects/rejections. No cited process or flow events were available to establish execution or egress, so successful exploitation is not demonstrated.

Protected workloads
One protected workload
Progression
Within-workload activity
Severity basis
Maximum incident posture

Observed impact

  • No confirmed compromise or command execution; inspected HTTP events show only 301/404 outcomes [redacted].
  • Operational impact appears limited to a short burst of rejected probe traffic [redacted].

Recommended actions

    Attack timeline

    1 incident threads

    Live progression remains visible; PII, native endpoints, hashes, and private identities do not.

    1. 1
      Opportunistic scanopen

      This is a true-positive opportunistic reconnaissance event, not a confirmed compromise. The incident’s cited sequence records rapid GET enumeration of PHP/WordPress probe paths against target privatekind; inspected examples produced only HTTP 301 redirects or 404 responses (HTTP [redacted], [redacted], [redacted], [redacted]). The detector’s aggregate is 39 requests across 20 unique probe paths in about 4.2 seconds, with all 39 classified as redirects/rejections. No cited process or flow events were available to establish execution or egress, so successful exploitation is not demonstrated.