← Back to context

Comment by deepersprout

14 hours ago

i started seeing a lot of scans on my webservers:

  ==> /var/log/apache2/access.log <==
  example.com:443 74.225.203.7 - - [21/Oct/2026:12:39:02 +0200] "GET /myglu.php HTTP/1.1" 200 837 "-" "-"
  example.com:80 74.225.203.7 - - [21/Oct/2026:12:39:02 +0200] "GET /bnmtp.php HTTP/1.1" 301 431 "-" "-"
  example.com:443 74.225.203.7 - - [21/Oct/2026:12:39:02 +0200] "GET /bnmtp.php HTTP/1.1" 200 837 "-" "-"
  example.com:80 74.225.203.7 - - [21/Oct/2026:12:39:02 +0200] "GET /wp-admin/includes/class-wp-site-list.php HTTP/1.1" 301 493 "-" "-"
  example.com:443 74.225.203.7 - - [21/Oct/2026:12:39:02 +0200] "GET /wp-admin/includes/class-wp-site-list.php HTTP/1.1" 200 837 "-" "-"
  example.com:80 74.225.203.7 - - [21/Oct/2026:12:39:02 +0200] "GET /wp-X1s2e6h3p7.php HTTP/1.1" 301 447 "-" "-"
  example.com:443 74.225.203.7 - - [21/Oct/2026:12:39:02 +0200] "GET /wp-X1s2e6h3p7.php HTTP/1.1" 200 837 "-" "-"
  example.com:80 74.225.203.7 - - [21/Oct/2026:12:39:03 +0200] "GET /flamini.php HTTP/1.1" 301 435 "-" "-"
  example.com:443 74.225.203.7 - - [21/Oct/2026:12:39:03 +0200] "GET /flamini.php HTTP/1.1" 200 837 "-" "-"
  example.com:80 74.225.203.7 - - [21/Oct/2026:12:39:03 +0200] "GET /alfa.php HTTP/1.1" 301 429 "-" "-"
  example.com:443 74.225.203.7 - - [21/Oct/2026:12:39:03 +0200] "GET /alfa.php HTTP/1.1" 200 837 "-" "-"
  example.com:80 74.225.203.7 - - [21/Oct/2026:12:39:03 +0200] "GET /wp-content/index.php HTTP/1.1" 301 453 "-" "-"
  example.com:443 74.225.203.7 - - [21/Oct/2026:12:39:03 +0200] "GET /wp-content/index.php HTTP/1.1" 200 837 "-" "-"
  example.com:80 74.225.203.7 - - [21/Oct/2026:12:39:03 +0200] "GET /wp-includes/ID3/about.php HTTP/1.1" 301 463 "-" "-"
  example.com:443 74.225.203.7 - - [21/Oct/2026:12:39:04 +0200] "GET /wp-includes/ID3/about.php HTTP/1.1" 200 837 "-" "-"
  example.com:80 74.225.203.7 - - [21/Oct/2026:12:39:04 +0200] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 301 467 "-" "-"
  example.com:443 74.225.203.7 - - [21/Oct/2026:12:39:04 +0200] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 200 837 "-" "-"
  example.com:80 74.225.203.7 - - [21/Oct/2026:12:39:04 +0200] "GET //wp-admin/js/index.php HTTP/1.1" 301 455 "-" "-"
  example.com:443 74.225.203.7 - - [21/Oct/2026:12:39:04 +0200] "GET /wp-admin/js/index.php HTTP/1.1" 200 837 "-" "-"
  example.com:80 74.225.203.7 - - [21/Oct/2026:12:39:04 +0200] "GET /wp-content/admin.php HTTP/1.1" 301 453 "-" "-"
  example.com:443 74.225.203.7 - - [21/Oct/2026:12:39:04 +0200] "GET /wp-content/admin.php HTTP/1.1" 200 837 "-" "-"
  example.com:80 74.225.203.7 - - [21/Oct/2026:12:39:04 +0200] "GET /wp-content/themes/index.php HTTP/1.1" 301 467 "-" "-"
  example.com:443 74.225.203.7 - - [21/Oct/2026:12:39:05 +0200] "GET /wp-content/themes/index.php HTTP/1.1" 200 837 "-" "-"

3 comments

deepersprout

Reply
dstu  13 hours ago

That looks like pretty typical scanner traffic, especially the WP routes. I wouldn’t assume it’s necessarily specific to this exploit.