Investigation Workspace

Entity: 20.119.217.110 (Ip)

Entity Details
Type
Ip
ASN
AS8075 - Microsoft Corporation
Threat Intelligence
Multiple suspicious WordPress-related paths accessed, including potential web shell (sf.php), unauthorized admin access attempts (wp-admin.php, wp-content/edit.php, wp-admin/css/index.php), and anomalous file in content directory (wp-content/1.php). This indicates an active attempt to compromise or exploit a WordPress site.
Linked Entities
TLS Fingerprints (1)
Hostnames Targeted
Hostname Request Count
www.darcherif.fr 307
Paths Targeted (with Request Counts)
Path Request Count
wp-good.php 2
classwithtostring.php 2
wp-content/admin.php 2
wp-includes/block-supports/ 1
wp-admin/themes.php 1
autoload_classmap/function.php 1
wp-includes/fonts/wp-login.php 1
wp-admin/css/colors/ocean/about.php 1
wp-includes/certificates/about.php 1
wp-admin/css/colors/blue/ 1
.well-known/acme-challenge/index.php 1
wp-includes/js/tinymce/skins/wordpress/images/index.php 1
wp-includes/PHPMailer/index.php 1
ckeditor/plugins/fontawesome/dialogs/ 1
wp-admin/css/colors/index.php 1
wp-includes/Text/Diff/index.php 1
admin.phphttps:/www-vn500.com/inputs.php 1
.well-known/gecko-litespeed.php 1
wp-includes/IXR/wp-login.php 1
wp-includes/ID3/file.php 1
wp-admin/maint/admin.php 1
wp-admin/file.php 1
wp-includes/customize/ 1
wp-content/uploads/ 1
wp-content/uploads/2023/ 1
wp-content/file.php 1
wp-admin/file-manaager2.php 1
wp-admin/autoload_classmap.php 1
wp-admin/js/about.php7 1
index/function.php 1
function/function.php 1
wp-includes/js/index.php 1
wp-includes/Text/lv.php 1
wp-content/uploads/2025/ 1
ALFA_DATA/alfacgiapi/ 1
wp-content/index.php 1
wp/wp-admin/includes/ 1
wp-content/plugins/ 1
about/function.php 1
wp-admin/index.php 1
wp-admin/css/colors 1
wp-admin/user/index.php 1
wp-content/x/index.php 1
wp-includes/admin.php 1
wp-content/edit.php 1
wp-content/upgrade/ 1
wp-admin/js/index.php 1
admin/function.php 1
wp-includes/rest-api/ 1
wp-admin/css/colors/about.php 1
🚫

Block

Multiple suspicious WordPress-related paths accessed, including potential web shell (sf.php), unauthorized admin access attempts (wp-admin.php, wp-content/edit.php, wp-admin/css/index.php), and anomalous file in content directory (wp-content/1.php). This indicates an active attempt to compromise or exploit a WordPress site.

2026-03-12 09:10:55