WordPress wlwmanifest.xml Scanner for 2026-10-20

Last Updated: 00:00 UTC

Bulk scanning for /wp-includes/wlwmanifest.xml, the Windows Live Writer manifest present on default WordPress installs. Hitting many hosts in sequence is the fingerprinting stage of a WordPress-targeted campaign that enumerates installs before launching plugin/theme exploits.

MITRE ATT&CK

Tactic: Reconnaissance (TA0043)
Technique: T1595.002 — Active Scanning: Vulnerability Scanning

Observed URIs

Attackers by Country

United States: 434Singapore: 223France: 83The Netherlands: 59Germany: 57India: 35United Kingdom: 32Japan: 29Bulgaria: 28Belgium: 22Indonesia: 17Australia: 14Brazil: 14Sweden: 12Canada: 12Vietnam: 7Seychelles: 7Malaysia: 6Hong Kong: 5Estonia: 5Ireland: 5South Africa: 4Finland: 4Norway: 4Pakistan: 3Morocco: 2Thailand: 2Ukraine: 2Switzerland: 2Türkiye: 2Iran: 2Montenegro: 2Italy: 2Albania: 2Slovenia: 1Bangladesh: 1Philippines: 1Lithuania: 1Poland: 1Czechia: 1Colombia: 1Argentina: 1Russia: 1Spain: 1Saudi Arabia: 1Greece: 1Slovakia: 1
United States43437.7%
Singapore22319.4%
France837.2%
The Netherlands595.1%
Germany574.9%
India353.0%
United Kingdom322.8%
Japan292.5%
Bulgaria282.4%
Belgium221.9%
Indonesia171.5%
Australia141.2%
Brazil141.2%
Sweden121.0%
Canada121.0%
Vietnam70.6%
Seychelles70.6%
Malaysia60.5%
Hong Kong50.4%
Estonia50.4%
Ireland50.4%
South Africa40.3%
Finland40.3%
Norway40.3%
Pakistan30.3%
Morocco20.2%
Thailand20.2%
Ukraine20.2%
Switzerland20.2%
Türkiye20.2%
Iran20.2%
Montenegro20.2%
Italy20.2%
Albania20.2%
Slovenia10.1%
Bangladesh10.1%
Philippines10.1%
Lithuania10.1%
Poland10.1%
Czechia10.1%
Colombia10.1%
Argentina10.1%
Russia10.1%
Spain10.1%
Saudi Arabia10.1%
Greece10.1%
Slovakia10.1%

IP Address : ASN : City/Provider

Share on: