WordPress wlwmanifest.xml Scanner for 2026-10-22

Oct 22, 2026 Exploitation

Last Updated: 00:00 UTC

Bulk scanning for /wp-includes/wlwmanifest.xml, the Windows Live Writer manifest present on default WordPress installs. Hitting many hosts in sequence is the fingerprinting stage of a WordPress-targeted campaign that enumerates installs before launching plugin/theme exploits.

MITRE ATT&CK

Tactic: Reconnaissance (TA0043)
Technique: T1595.002 — Active Scanning: Vulnerability Scanning

Observed URIs

Attackers by Country

United States: 238Singapore: 169France: 36United Kingdom: 32Germany: 30The Netherlands: 27Australia: 23India: 16Indonesia: 12Bulgaria: 11Türkiye: 10Sweden: 9Belgium: 8Russia: 7Japan: 6Seychelles: 6Switzerland: 5Canada: 4Hong Kong: 3Brazil: 3South Korea: 3Norway: 3Finland: 3Bangladesh: 2Morocco: 2Malaysia: 2Czechia: 2Estonia: 2Vietnam: 1Thailand: 1South Africa: 1Lebanon: 1Ghana: 1Egypt: 1Poland: 1Ivory Coast: 1United Arab Emirates: 1Ukraine: 1Andorra: 1Slovakia: 1
United States23834.7%
Singapore16924.6%
France365.2%
United Kingdom324.7%
Germany304.4%
The Netherlands273.9%
Australia233.4%
India162.3%
Indonesia121.7%
Bulgaria111.6%
Türkiye101.5%
Sweden91.3%
Belgium81.2%
Russia71.0%
Japan60.9%
Seychelles60.9%
Switzerland50.7%
Canada40.6%
Hong Kong30.4%
Brazil30.4%
South Korea30.4%
Norway30.4%
Finland30.4%
Bangladesh20.3%
Morocco20.3%
Malaysia20.3%
Czechia20.3%
Estonia20.3%
Vietnam10.1%
Thailand10.1%
South Africa10.1%
Lebanon10.1%
Ghana10.1%
Egypt10.1%
Poland10.1%
Ivory Coast10.1%
United Arab Emirates10.1%
Ukraine10.1%
Andorra10.1%
Slovakia10.1%

IP Address : ASN : City/Provider

Share on: