Back to evidence

Sanitized live incident

Opportunistic scan

Native source identity and targetable endpoints are private.

mediumopen
Confidence
96%
First seen
Aug 19, 3:57:18 PM PDT
Evidence through
Aug 19, 3:57:24 PM PDT
AI status
Revising
True positive98% confidence

This is a true positive for opportunistic reconnaissance: the detector recorded a rapid cluster of 39 GET requests spanning 20 PHP/WordPress probe paths against target privatekind. Verified HTTP samples at the beginning and end of the burst are categorized as php_or_wordpress_probe and received 301 or 404 responses [[redacted], [redacted], [redacted], [redacted]]. The evidence establishes enumeration activity, but not successful exploitation. HTTP status is not dispositive, response-content semantics were not exposed, and the incident cites no process or flow events with which to evaluate execution or outbound consequences.

Attack stage
Reconnaissance / PHP and WordPress web-shell path enumeration
Model
gpt-5.6-sol · 6 evidence calls

Observed impact

  • External enumeration traffic reached the target-facing HTTP service; the cited HTTP events show probe handling but do not establish compromise [[redacted], [redacted], bd068b40-f9cc-4e05-b
  • No host execution, persistence, lateral movement, command-and-control, or data theft is proven by the evidence cited in this incident.

Deterministic signals

Http.php webshell enumeration96%

Rapid enumeration of PHP and WordPress web-shell paths

279 observations · 12 http

Explicit uncertainty

  • The incident cites HTTP evidence only. Process and flow evidence queries could not evaluate the HTTP IDs because no process-plane or flow-plane events were cited, so workload execution and outbound-network consequences cannot be determined from those planes.
  • HTTP response status alone cannot establish exploit success or failure. The bounded summaries expose response sizes and hashes but not semantic response content, so they cannot rule in or rule out server-generated command output.
  • The source_key is a traffic/workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than a unique actor.
  • Downstream workload affinity is inferred from configured target routing and is not an observed per-request trace edge.

Recommended actions

  1. Retain the gateway records and monitor for recurrence or escalation from the same source cluster and similar PHP/WordPress probe categories.
  2. Review application and workload logs for the narrow incident window beginning 2026-08-19T22[redacted].636Z for request handling anomalies, unexpected PHP execution, file creation, or authentication events; correlate independently rather than assuming request-to-process causality.
  3. Verify that target privatekind is not expected to expose WordPress or arbitrary PHP endpoints, and inspect its deployed content for unauthorized web-shell-like files if such exposure is unexpected.
  4. Maintain proportionate gateway controls such as rate limiting or blocking of known web-shell probe patterns, while accounting for the possibility that the source cluster represents shared infrastructure.