WordPress wlwmanifest.xml Scanner for 2026-10-19

Last Updated: 00:00 UTC

Bulk scanning for /wp-includes/wlwmanifest.xml, the Windows Live Writer manifest present on default WordPress installs. Hitting many hosts in sequence is the fingerprinting stage of a WordPress-targeted campaign that enumerates installs before launching plugin/theme exploits.

MITRE ATT&CK

Tactic: Reconnaissance (TA0043)
Technique: T1595.002 — Active Scanning: Vulnerability Scanning

Observed URIs

Attackers by Country

United States: 691Singapore: 426France: 93Germany: 71India: 60The Netherlands: 56United Kingdom: 46Japan: 39Belgium: 34Indonesia: 30Australia: 26Bulgaria: 23Seychelles: 18Canada: 13Hong Kong: 12Sweden: 12Vietnam: 8Brazil: 8Finland: 8Ireland: 7Taiwan: 6Iran: 5South Africa: 4Poland: 4Russia: 4Albania: 4Thailand: 3Switzerland: 3Estonia: 3Morocco: 2Bangladesh: 2Mexico: 2Malaysia: 2Argentina: 2Italy: 2South Korea: 2United Arab Emirates: 2Montenegro: 2Pakistan: 2Slovenia: 1China: 1Lithuania: 1Ukraine: 1Lebanon: 1Hungary: 1Kazakhstan: 1Colombia: 1Romania: 1Laos: 1Monaco: 1Türkiye: 1Iceland: 1Norway: 1Chile: 1Spain: 1Saudi Arabia: 1Greece: 1Andorra: 1
United States69139.4%
Singapore42624.3%
France935.3%
Germany714.0%
India603.4%
The Netherlands563.2%
United Kingdom462.6%
Japan392.2%
Belgium341.9%
Indonesia301.7%
Australia261.5%
Bulgaria231.3%
Seychelles181.0%
Canada130.7%
Hong Kong120.7%
Sweden120.7%
Vietnam80.5%
Brazil80.5%
Finland80.5%
Ireland70.4%
Taiwan60.3%
Iran50.3%
South Africa40.2%
Poland40.2%
Russia40.2%
Albania40.2%
Thailand30.2%
Switzerland30.2%
Estonia30.2%
Morocco20.1%
Bangladesh20.1%
Mexico20.1%
Malaysia20.1%
Argentina20.1%
Italy20.1%
South Korea20.1%
United Arab Emirates20.1%
Montenegro20.1%
Pakistan20.1%
Slovenia10.1%
China10.1%
Lithuania10.1%
Ukraine10.1%
Lebanon10.1%
Hungary10.1%
Kazakhstan10.1%
Colombia10.1%
Romania10.1%
Laos10.1%
Monaco10.1%
Türkiye10.1%
Iceland10.1%
Norway10.1%
Chile10.1%
Spain10.1%
Saudi Arabia10.1%
Greece10.1%
Andorra10.1%

IP Address : ASN : City/Provider

Share on: