Urgent Threat Alert: Mass Scanning and Targeted Probing on WordPress Sites

The analysis of recent WordPress statistics reveals a high volume of automated scanning and reconnaissance activity, indicative of a continuous and pervasive threat landscape. The data points to both widespread vulnerability hunting and more specific probing for configuration files and old vulnerabilities, which could precede a targeted attack or lead to mass compromise.

Key Observations and Threat Analysis

The statistical breakdown highlights several critical areas of concern: high-volume automated scanning, targeted information disclosure attempts, and a notable focus on a specific, potentially vulnerable WordPress component.

1. High-Volume Scanning and Automation

The sheer volume of requests, dominated by two specific user agents, points to automated, large-scale scanning and reconnaissance efforts.

Go-http-client/1.1 (40.5%): This user agent is frequently associated with Go-based tools, including custom scripts, security scanners, and bots. While sometimes used by legitimate services, its high volume in the context of probing URLs strongly suggests vulnerability scanning or web scraping by both benevolent and malicious entities.
Mozilla/5.0 (l9scan/2.0.836313e2031313e2630313e28363; +https://leakix.net) (27%): The explicit inclusion of leakix.net confirms this activity as a known Internet-wide vulnerability scanner and data collection project. LeakIX is a platform that indexes publicly exposed data and vulnerabilities. While its purpose is often described as security research, the information it collects is publicly available and can be exploited by malicious actors.

2. Targeted Information Disclosure and Configuration File Hunting

The top destination URLs reveal a clear focus on discovering exposed sensitive files and common application endpoints.

/.env (8.1%): This is the single most targeted URI. The .env file is used by many modern applications (including those running on WordPress environments, such as those using Laravel or certain deployment practices) to store environment variables, which often include database credentials, API keys, and other critical secrets. Successful access to this file would result in an immediate, critical information disclosure and likely lead to a full system compromise.
/config.json and /.DS_Store / /.vscode/sftp.json: Probing for configuration files (config.json) and developer artifact files (.DS_Store, used by macOS, and .vscode/sftp.json, used by VS Code for SFTP settings) indicates an attacker is looking for misconfigured or carelessly deployed sites where source code or development credentials may be exposed.

3. Exploitation and Lateral Probing

The data shows attempts to exploit a specific, known WordPress plugin vulnerability, alongside probing for a separate system’s attack vector.

/wp-content/plugins/visitor-stats-v1.0.6/readme.txt: This request is a classic fingerprinting attempt for a specific, potentially vulnerable component. The plugin WP Visitor Statistics (Real Time Traffic) has a history of vulnerabilities, including SQL Injection and Sensitive Information Exposure (CVEs exist for various versions, such as older versions being vulnerable to Unauthenticated SQLi). Probing for the readme.txt is an attempt to identify if an unpatched, vulnerable version of this plugin is installed.
/owa/auth/x.js and /login / /sdk/: Requests to /owa/auth/x.js are a clear indicator of reconnaissance for Microsoft Exchange Server’s Outlook Web Access (OWA). This vector is frequently probed for vulnerabilities like ProxyShell or ProxyNotShell. Even if the site is purely WordPress, the attacker may be assuming the IP hosts multiple services or is part of a larger corporate network. The generic /login and /sdk/ probes are typical attempts to find admin panels or API endpoints.

Known Campaigns, Vulnerabilities, and APT Links

The observed activity aligns with common tactics used by both criminal threat groups and State-Sponsored Advanced Persistent Threats (APTs) for initial access and reconnaissance.

Notable Vulnerabilities and Attack Vectors

Sensitive File Disclosure (.env, .DS_Store): This technique is a constant of web attacks. The goal is to obtain credentials or secrets, which can be instantly weaponized.
WordPress Plugin Vulnerabilities (e.g., visitor-stats): Unpatched WordPress plugins are a primary vector for compromise. Attack campaigns often target newly discovered flaws (N-day vulnerabilities) or exploit older, known, but commonly unpatched vulnerabilities to gain Remote Code Execution (RCE) or SQL Injection (SQLi) access.
Exchange OWA Probing (/owa/auth/x.js): This is a key attack surface for APT groups such as Hafnium (known for the initial 2021 Exchange attacks) and other groups leveraging vulnerabilities like ProxyShell (CVE-2021-34473, etc.) and ProxyNotShell (CVE-2022-41040, etc.) for high-value targets.

Potential APT and Threat Group Overlap

While the majority of this activity is likely opportunistic and criminal (driven by the high-volume scanners), the subsequent exploitation of compromised WordPress sites or the lateral probing for Exchange vulnerabilities often forms part of larger APT campaigns.

Initial Access Brokers (IABs) and Ransomware Groups: High-volume scanning for easy-to-exploit flaws like exposed .env files or SQLi in plugins is the hallmark of IABs, who sell access to networks, and ransomware groups, who automate mass exploitation.
Chinese and Russian APTs: Groups like APT41 (Wicked Panda) and APT28/APT29 have a history of leveraging N-day and zero-day vulnerabilities in common web applications and critical infrastructure components (like Exchange) as an initial foothold for espionage and lateral movement. The use of robust, non-standard user agents like Go-http-client/1.1 can sometimes be a generic cover for such activity, making attribution difficult.

Recommendations: Mitigation and Defense

To neutralize the immediate threats and harden the WordPress installation against future attacks, implement the following actions:

Immediate Security Actions

Block Malicious IPs: Immediately block the top offending IP address 134.209.25.199 and other highly frequent sources.
Inspect and Remove Sensitive Files: Verify the web root and all subdirectories, ensuring .env files, .DS_Store files, .vscode directories, and any other development artifacts are not publicly accessible. Use your web server configuration (e.g., .htaccess or Nginx configuration) to explicitly deny access to these file types.
Audit and Patch Plugins: Verify the installed version of the WP Visitor Statistics (Real Time Traffic) plugin. If it is v1.0.6 or any known vulnerable version, update immediately or remove it if not essential.

Long-Term Hardening

Web Application Firewall (WAF): Deploy a WAF (e.g., Cloudflare, Sucuri, or a robust hosting WAF) to automatically block requests to known malicious paths (like /owa/auth/x.js) and filter suspicious user agents and common exploitation patterns.
Strong Authentication: Enforce Multi-Factor Authentication (MFA) on all administrator and high-privilege accounts.
Regular Updates: Establish a rigorous schedule for patching WordPress core, plugins, and themes to mitigate N-day vulnerability exploitation.
Honeypot/Monitoring: Implement a security monitoring solution to alert on probes for highly sensitive files like .env, as this indicates a serious, targeted attempt at compromise.