Back to evidence

Sanitized live incident

Opportunistic scan

Native source identity and targetable endpoints are private.

mediumopen
Confidence
96%
First seen
Aug 27, 7:11:26 PM PDT
Evidence through
Aug 27, 7:11:50 PM PDT
AI status
Complete
True positive99% confidence

The incident is a true positive for opportunistic PHP/WordPress web-shell path enumeration, not a confirmed compromise. The detector aggregated 39 requests across 20 probe paths in roughly 4.3 seconds, and the reviewed immutable HTTP records consistently classify the requests as php_or_wordpress_probe traffic from the same source cluster to target privatekind [http:[redacted], http:[redacted], http:[redacted]]. Sampled responses were redirects or rejections (301/404), with no request bodies [same references]. This supports a reconnaissance/enumeration verdict. It does not establish exploitation, command execution, persistence, or outbound activity; no process or flow evidence was cited by the incident and therefore those evidence tools could not provide corroboration.

Attack stage
Reconnaissance / attempted web-shell discovery
Model
gpt-5.6-sol · 7 evidence calls

Observed impact

  • Automated PHP/WordPress probe traffic reached target privatekind; reviewed HTTP events received 301 or 404 outcomes [http:[redacted], http:[redacted], http:4977296b-36bf-42d0-80ca-360cf377
  • Observed impact is limited to scanning and request handling; the cited HTTP evidence does not prove successful exploitation or workload compromise [http:[redacted], http:[redacted]].

Deterministic signals

Http.php webshell enumeration96%

Rapid enumeration of PHP and WordPress web-shell paths

232 observations · 12 http

Explicit uncertainty

  • The source_key is a traffic/workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Downstream workload affinity is inferred from configured routing and is not an observed per-request trace edge.
  • The incident cites no process-plane or flow-plane event IDs. Queries to those evidence tools therefore returned no corroborating evidence, leaving command execution and outbound network consequences unverified.
  • Bounded HTTP summaries exclude raw response bodies. A 404 response body was present in sampled evidence, but its content is unavailable here; status alone cannot prove success or failure.

Recommended actions

  1. Continue monitoring this source cluster and related clusters for follow-up requests, especially POST requests, parameters, authentication attempts, or successful responses to PHP/WordPress paths.
  2. Apply rate limiting or temporary blocking for the source cluster if consistent with policy and if the activity persists; account for possible shared proxy/NAT attribution.
  3. Verify that unexpected PHP files, web shells, obsolete WordPress components, and exposed administrative paths are absent from the routed workload; review deployment integrity through normal operational controls.
  4. Keep the web stack and WordPress components patched and remove unused plugins, themes, and PHP entry points. No emergency host isolation is justified by the currently cited evidence alone.