Checking for 404 errors in your logs can reveal more than just broken links, it can also expose files and URLs that attackers are actively scanning for. To track this behavior, we set up hundreds of honeypots and analyzed live web traffic data, giving us insight into which files and URLs are being targeted across the internet.
The table bellow list the top URLs being scanned on WordPress sites in the past 72 hours. This list of updated daily and shows the top plugins, backdoors and files that attacker are lookin for specifically to WordPress.
| Rank | Scanned URL | Counter |
|---|---|---|
| #1 | /wp-login.php | 40,178 |
| #2 | /wp-json/oembed/1.0/embed | 1,523 |
| #3 | /wp-cron.php | 1,335 |
| #4 | /wordpress | 1,000 |
| #5 | /wp-includes/wlwmanifest.xml | 902 |
| #6 | /wp-content/plugins/WordPressCore/include.php | 884 |
| #7 | /web/wp-includes/wlwmanifest.xml | 880 |
| #8 | /wordpress/wp-includes/wlwmanifest.xml | 872 |
| #9 | /wp/wp-includes/wlwmanifest.xml | 863 |
| #10 | /blog/wp-includes/wlwmanifest.xml | 831 |
| #11 | /2019/wp-includes/wlwmanifest.xml | 827 |
| #12 | /shop/wp-includes/wlwmanifest.xml | 823 |
| #13 | /wp | 765 |
| #14 | /website/wp-includes/wlwmanifest.xml | 704 |
| #15 | /news/wp-includes/wlwmanifest.xml | 701 |
| #16 | /wp-admin | 648 |
| #17 | /wp-cli.php | 515 |
| #18 | /wp-content/plugins/hellopress/wp_filemanager.php | 504 |
| #19 | /wp-json/intercom/v1/webhook | 504 |
| #20 | /wp.php | 495 |
| #21 | /2018/wp-includes/wlwmanifest.xml | 483 |
| #22 | /wp-cli.phar | 469 |
| #23 | /wp-content/plugins/fix/up.php | 467 |
| #24 | /wp-plain.php | 442 |
| #25 | /wp-admin/css | 396 |
| #26 | /appWP/lab/wp-admin/css/colors/blue/blue.php | 392 |
| #27 | /2020/wp-includes/wlwmanifest.xml | 373 |
| #28 | /wp-content/style.php | 361 |
| #29 | /wp-content/themes/style.php | 361 |
| #30 | /wp-admin/style.php | 345 |
| #31 | /wp-editor.php | 338 |
| #32 | /wp1/wp-includes/wlwmanifest.xml | 331 |
| #33 | /wp-content/plugins/hellopress/wp_mna.php | 306 |
| #34 | /wp-admin/index.php | 305 |
| #35 | /wp-content/themes/seotheme/db.php | 300 |
| #36 | /test/wp-includes/wlwmanifest.xml | 269 |
| #37 | /wp-json/bbp-api/v1/users | 263 |
| #38 | /site/wp-includes/wlwmanifest.xml | 251 |
| #39 | /cms/wp-includes/wlwmanifest.xml | 250 |
| #40 | /wp-json/buddypress/v1/members | 249 |
| #41 | /wp-json/ldlms/v2/users | 224 |
| #42 | /wp-admin.php | 221 |
| #43 | /wp-admin/edit-tags.php | 220 |
| #44 | /wp-admin/edit.php | 219 |
| #45 | /wp-cron | 213 |
| #46 | /wp-content/plugins/one_images_user/one_images_user.php | 207 |
| #47 | /wp-content/plugins/one_images_usder/oned_images_user.php | 204 |
| #48 | /wp-content/plugins/pwnd/pwnd.php | 187 |
| #49 | /wp-admin/post-new.php | 184 |
| #50 | /wp-admin/profile.php | 181 |
| #51 | /wp-2019.php | 175 |
| #52 | /wp-json/wc/v3/customers | 175 |
| #53 | /wp-admin/plugins.php | 173 |
| #54 | /wp-content/admin.php | 168 |
| #55 | /wp-content/about.php | 160 |
| #56 | /wp-content/themes/wp-pridmag/init.php | 151 |
| #57 | /wp-trackback.php | 150 |
| #58 | /wp-content/function.php | 148 |
| #59 | /2021/wp-includes/wlwmanifest.xml | 147 |
| #60 | /wp-content/classwithtostring.php | 141 |
| #61 | /wp-admin/install.php | 138 |
| #62 | /wp-admin/css/wp-conflg.php | 135 |
| #63 | /wp-admin/setup-config.php | 133 |
| #64 | /wp-json | 125 |
| #65 | /wp-22.php | 125 |
| #66 | /wp-sitemap-users-1.xml | 124 |
| #67 | /wp-content/wp-conflg.php | 123 |
| #68 | /wp-content/autoload_classmap.php | 122 |
| #69 | /wordpress/wp-admin/setup-config.php | 121 |
| #70 | /wp-content/plugins/apikey/apikey.php | 118 |
| #71 | /wp-content/wp.php | 111 |
| #72 | /wp-content/index.php | 110 |
| #73 | /wp-content/abcd.php | 109 |
| #74 | /wpssl.php | 108 |
| #75 | /wp-content/moon.php | 108 |
| #76 | /wp-content/ioxi-o.php | 108 |
| #77 | /wpo.php | 107 |
| #78 | /wp2/wp-includes/wlwmanifest.xml | 106 |
| #79 | /wp-activate.php | 105 |
| #80 | /wp-sitemap.xml | 103 |
| #81 | /wp-includes/fonts/themes.php | 102 |
| #82 | /sito/wp-includes/wlwmanifest.xml | 101 |
| #83 | /wp-content/install.php | 99 |
| #84 | /wp-good.php | 98 |
| #85 | /wp-content/file.php | 96 |
| #86 | /wp-admin/zwso.php | 94 |
| #87 | /wp-configs.php | 89 |
| #88 | /wp-content/goods.php | 88 |
| #89 | /wp-content/edit.php | 88 |
| #90 | /wp-admin/maint/index.php | 87 |
| #91 | /wp-content/mm.php | 87 |
| #92 | /wp-content/makeasmtp.php | 87 |
| #93 | /wp-content/gecko.php | 87 |
| #94 | /wp-content/buy.php | 87 |
| #95 | /wp-content/akc.php | 87 |
| #96 | /wp-content/themes/include.php | 87 |
| #97 | /wp-content/code.php | 86 |
| #98 | /wp-content/asasx.php | 86 |
| #99 | /wp-content/aa.php | 86 |
| #100 | /wp-content/ova.php | 86 |
| #101 | /wp-content/ab.php | 86 |
| #102 | /wp-content/lock360.php | 86 |
| #103 | /wp-content/wsa.php | 86 |
| #104 | /wp-content/themes/about.php | 85 |
| #105 | /wp-content/bala.php | 85 |
| #106 | /wp-content/alfa.php | 85 |
| #107 | /wp-content/themes/hello_dolly_v2.php | 82 |
| #108 | /wp-content/plugins/HelloDollyV2/hello_dolly_v2.php | 82 |
| #109 | /wp-conflg.php | 81 |
| #110 | /wp-content/themes/seotheme/mar.php | 80 |
| #111 | /wp-admin/images | 79 |
| #112 | /wp-content/plugins/TOPXOH/wDR.php | 78 |
| #113 | /wp-content/plugins/apikey/apikey.php.suspected | 76 |
| #114 | /wp-content/403.php | 76 |
| #115 | /wp-includes/autoload_classmap.php | 76 |
| #116 | /wp-includes/fonts/about.php | 74 |
| #117 | /wp-content/cong.php | 72 |
| #118 | /wpc.php | 72 |
| #119 | /upload/wp-info.php | 71 |
| #120 | /wp-includes/IXR/admin.php | 71 |
| #121 | /wp-includes/js/crop/zmFM.php | 69 |
| #122 | /wp-includes/html-api/wp-conflg.php | 69 |
| #123 | /wp-includes/ID3/rk2.php | 69 |
| #124 | /wp-includes/Text/Diff/Engine/about.php | 69 |
| #125 | /wp-includes/theme-compat/wp-login.php | 68 |
| #126 | /wp-admin/css/colors/blue/index.php | 67 |
| #127 | /media/wp-includes/wlwmanifest.xml | 66 |
| #128 | /wp-includes/system_log.php | 66 |
| #129 | /wp-admin/css/about.php | 66 |
| #130 | /wp-content/w.php | 64 |
| #131 | /wp-content/chosen.php | 64 |
| #132 | /wp-content/autoload_classmap/function.php | 64 |
| #133 | /wp-content/tinyfilemanager.php | 64 |
| #134 | /wp-content/users.php | 64 |
| #135 | /wp-content/goat.php | 64 |
| #136 | /wp-config.php.bak | 63 |
| #137 | /wp-content/plugins/WordPressCore-1/include.php | 63 |
| #138 | /wp-content/flower.php | 63 |
| #139 | /wp-content/file2.php | 63 |
| #140 | /wp-content/atomlib.php | 63 |
| #141 | /wp-admin/admin-wolf.php | 63 |
| #142 | /wp-admin/maint/maint.php | 62 |
| #143 | /wp-includes/assets/index.php | 62 |
| #144 | /wp-content/plugins/include.php | 62 |
| #145 | /wp-json/litespeed/v1/cdn_status | 59 |
| #146 | /wp-json/sure-triggers/v1/automation/action | 59 |
| #147 | /wp-content/plugins/HelloDollyV2-1/hello_dolly_v2.php | 59 |
| #148 | /wp-content/plugins/HelloDollyV2_ncvt/hello_dolly_v2.php | 58 |
| #149 | /wp-content/plugins/hello_dolly_v2.php | 58 |
| #150 | /wp-content/plugins/admin.php | 53 |
| #151 | /wp-includes/style.php | 53 |
| #152 | /wp-admin/maint/admin.php | 52 |
| #153 | /wp-admin/wp-conflg.php | 52 |
| #154 | /wp-admin/js/wp-conflg.php | 52 |
| #155 | /wp-admin/maint/about.php | 51 |
| #156 | /wp-includes/ID3/about.php | 51 |
| #157 | /wp-content | 51 |
| #158 | /wp-admin/network/wp-conflg.php | 50 |
| #159 | /wp-content/plugins/wps-hide-login/wps-hide-login.php | 50 |
| #160 | /wp-includes/js/codemirror/index.php | 48 |
| #161 | /wp-includes/ID3 | 48 |
| #162 | /wp-admin/images/index.php | 48 |
| #163 | /wp-includes/style-engine/about.php | 47 |
| #164 | /wp-content/themes/pridmag/db.php | 47 |
| #165 | /wp-admin/includes/xmrlpc.php | 46 |
| #166 | /wp-content/plugins/pwnd-1/pwnd.php | 46 |
| #167 | /wp-setup.php | 45 |
| #168 | /wp-content/plugins/index.php | 43 |
| #169 | /wp-includes/rest-api/fields/index.php | 43 |
| #170 | /wp-content/edit-wolf.php | 43 |
| #171 | /wp-content/edit-fox.php | 43 |
| #172 | /wp-includes/IXR/autoload_classmap.php | 42 |
| #173 | /wp-setup.sh | 42 |
| #174 | /wp-config.php-backup | 42 |
| #175 | /wp-content/themes/travel/issue.php | 42 |
| #176 | /wp-content/radio.php | 41 |
| #177 | /wp-content/mysql.bak | 41 |
| #178 | /wp-content/uploads/dump.bak | 41 |
| #179 | /wp-content/mysql.sql | 41 |
| #180 | /wp-content/uploads/dump.sql | 41 |
| #181 | /wp-config | 41 |
| #182 | /wp-content/uploads | 41 |
| #183 | /wp-f.php | 41 |
| #184 | /wp-content/themes/oxygen-is-not-a-theme/assets/fonts/inter/Inter-VariableFont_slnt,wght.woff2 | 41 |
| #185 | /wp-includes/images/wp-login.php | 40 |
| #186 | /wp-content/plugins/seoplugins/db.php | 40 |
| #187 | /wp-content/plugins/linkpreview/db.php | 40 |
| #188 | /module/wpblog/archive | 40 |
| #189 | /wp-content/themes/astra/inc/ki1k.php | 38 |
| #190 | /wp-admin/js/index.php | 38 |
| #191 | /wp-aaa.php | 38 |
| #192 | /wpls.php | 38 |
| #193 | /wp-admin/admin-ajax.php | 38 |
| #194 | /wp-content/uploads/2020/06/Mercado-de- | 38 |
| #195 | /wp-includes/css/dist/preferences/wp-login.php | 37 |
| #196 | /wp-includes/SimplePie/wp-login.php | 37 |
| #197 | /wp-update.php | 37 |
| #198 | /wp-content/plugins/pwnd/as.php | 36 |
| #199 | /features/wordpress-management-tools | 36 |
| #200 | /wp-includes/customize/about.php | 35 |
| #201 | /wp-includes/Requests/Text/admin.php | 35 |
| #202 | /wp-content/product.php | 35 |
| #203 | /wp-content/upgrade/about.php | 34 |
| #204 | /wp-includes/theme-compat/chosen.php | 34 |
| #205 | /wp-includes/certificates/plugins.php | 34 |
| #206 | /wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php | 34 |
| #207 | /wp/wp-login.php | 34 |
| #208 | /wp-includes/fonts/index.php | 33 |
| #209 | /wp-content/themes/twentytwentytwo | 32 |
| #210 | /wp-admin/alfa.php | 30 |
| #211 | /wp-admin/user/about.php | 29 |
| #212 | /wp-gr.php | 29 |
| #213 | /wp-admin/images/admin.php | 29 |
| #214 | /wp-content/video | 29 |
| #215 | /wp-admin/classwithtostring.php | 28 |
| #216 | /wp-content/themes | 28 |
| #217 | /wp-sigunq.php | 28 |
| #218 | /wp-admin/js/about.php | 28 |
| #219 | /wp-includes/class-wp-recovery-mode-file-service.php | 28 |
| #220 | /wp-admin/network/chosen.php | 27 |
| #221 | /wp-admin/js/widgets/about.php | 27 |
| #222 | /wp-includes/pomo | 27 |
| #223 | /wp-admin/dropdown.php | 27 |
| #224 | /wp-content/plugins/newsletters-lite/newsletters-lite-ajax.php | 27 |
| #225 | /wp-admin/wsa.php | 26 |
| #226 | /wp-admin/wp.php | 26 |
| #227 | /wp-admin/lock360.php | 26 |
| #228 | /wp-admin/js | 26 |
| #229 | /wp-admin/code.php | 26 |
| #230 | /wp-admin/asasx.php | 26 |
| #231 | /wp-admin/ab.php | 26 |
| #232 | /wp-admin/ioxi-o.php | 26 |
| #233 | /wp-blog-header.php | 26 |
| #234 | /wp-includes/js/codemirror | 26 |
| #235 | /wp-content/plugins/contact-form-7 | 26 |
| #236 | /wp-json/wp/v2/media/525 | 24 |
| #237 | /wp-json/wp/v2/media/524 | 24 |
| #238 | /wp-json/wp/v2/media/501 | 24 |
| #239 | /wp-json/wp/v2/media/571 | 24 |
| #240 | /wp-json/wp/v2/media/522 | 24 |
| #241 | /wp-content/themes/news-portal/error.php | 24 |
| #242 | /wp-admin/css/colors/blue | 24 |
| #243 | /wp-content/plugins/woocommerce | 24 |
| #244 | /wp-includes/js/thickbox/thickbox.php | 24 |
| #245 | /wp-admin/maint | 23 |
| #246 | /wp-json/oembed/1.0/embed/activity | 23 |
| #247 | /wp-content/plugins/wp-automatic/inc/csv.php | 23 |
| #248 | /wordpress/wp-login.php | 23 |
| #249 | /wp-content/plugins/about.php | 23 |
| #250 | /wp-includes/ID3/code.php | 22 |
| #251 | /wp-includes/ID3/autoload_classmap.php | 22 |
| #252 | /wp-includes/ioxi-o.php | 22 |
| #253 | /wp-content/plugins/revsliderswp/wp-login.php | 22 |
| #254 | /loja/wp-login.php | 22 |
| #255 | /wp-api.php | 22 |
| #256 | /wp-admin/images/moon.php | 22 |
| #257 | /wp-content/plugins/ph-file-manager/wp-file.php | 21 |
| #258 | /wp-content/plugins/shell/about.php | 21 |
| #259 | /wp-aa.php | 21 |
| #260 | /wp-content/plugins/linkpreview | 21 |
| #261 | /shop/wp-login.php | 21 |
| #262 | /wp-content/plugins/simple/simple.php | 21 |
| #263 | /wp-content/uploads/Vi%CC%81deo-Banner.mp4 | 20 |
| #264 | /wp-includes/assets | 20 |
| #265 | /wp-content/themes/divi | 20 |
| #266 | /wp-content/themes/astra | 20 |
| #267 | /wp-content/plugins/wp-help/admin/wp-fclass.php | 20 |
| #268 | /blog/wp-login.php | 20 |
| #269 | /store/wp-login.php | 20 |
| #270 | /wp-includes | 20 |
| #271 | /wp-includes/fonts/admin.php | 20 |
| #272 | /wp-json/wp/v2/users | 19 |
| #273 | /wp-content/themes/twentytwentytwo/index.php | 19 |
| #274 | /wp-content/themes/jaida/lang.php | 19 |
| #275 | /wp-content/themes/twentytwentythree | 19 |
| #276 | /wp-file.php | 19 |
| #277 | /wp-includes/blocks/comments | 18 |
| #278 | /wp-admin/js/widgets | 18 |
| #279 | /wp-mail.php | 18 |
| #280 | /wp-mn.php | 18 |
| #281 | /wp-content/themes/fix.php | 18 |
| #282 | /wp-content/fix.php | 18 |
| #283 | /wp-content/mu-plugins-old | 18 |
| #284 | /wp-admin/css/colors/midnight/about.php | 18 |
| #285 | /wp-includes/Text/index.php | 17 |
| #286 | /wp-includes/block-patterns/index.php | 17 |
| #287 | /wp-includes/rest-api/fields | 17 |
| #288 | /wp-includes/js/crop | 17 |
| #289 | /wp-includes/Text | 17 |
| #290 | /wp-content/plugins/root-file-manager/wp-file.php | 17 |
| #291 | /wp-content/plugins/ql-cost-calculator/js/jquery.qtip.min.map | 17 |
| #292 | /wp-content/item.php | 17 |
| #293 | /wp-admin/css/index.php | 16 |
| #294 | /wp-content/plugins/wp-help/mini.php | 16 |
| #295 | /wp-json/jetpack/v4/module/protect/data | 16 |
| #296 | /wp-admin/fix.php | 16 |
| #297 | /wp-blog.php | 15 |
| #298 | /wp-content/themes/shell20250630.php | 15 |
| #299 | /wp-content/shell20250630.php | 15 |
| #300 | /wp-content/plugins/woocommerce/assets/fonts/WooCommerce.eot | 14 |
| #301 | /wp-json/buddyboss-app/v1/signup/form | 14 |
| #302 | /wp-admin/about.php | 13 |
| #303 | /wp-l0gin.php | 13 |
| #304 | /wp-includes/rest-api/about.php | 13 |
| #305 | /wp-includes/images/about.php | 13 |
| #306 | /wp-info.php | 13 |
| #307 | /wp-includes/Text/about.php | 13 |
| #308 | /wp-admin/images/about.php | 13 |
| #309 | /wp-includes/Requests/about.php | 13 |
| #310 | /wp-admin/undefinedjetpack/v4/site/benefits | 13 |
| #311 | /wp-admin/undefinedjetpack/v4/connection/data | 13 |
| #312 | /wp-includes/IXR/about.php | 12 |
| #313 | /wp-content/plugins/seoplugins/mar.php | 12 |
| #314 | /wp-includes/SimplePie/about.php | 12 |
| #315 | /wp-admin/includes/about.php | 12 |
| #316 | /wp-content/themes/twentyfive/include.php | 12 |
| #317 | /wp-login | 12 |
| #318 | /wp-content/plugins/WordPressCore | 12 |
| #319 | /wp-admin/shell20250630.php | 12 |
| #320 | /wp-content/plugins/WordPressCore_lvig/include.php | 12 |
| #321 | /wp-content/plugins/HelloDollyV2_tuga/hello_dolly_v2.php | 12 |
| #322 | /wpbrclci_adm | 11 |
| #323 | /wp-content/themes/digital-download/new.php | 11 |
| #324 | /wp-admin/remote | 11 |
| #325 | /wp-head.php | 11 |
| #326 | /wp-admin/admin.php | 11 |
| #327 | /wp-includes/about.php | 11 |
| #328 | /wp-content/uploads/2023/07/EVENTO-PRESENCIAL-Inauguracao-Oficial-Demarest-Brasilia.ics | 11 |
| #329 | /wp-header.php | 11 |
| #330 | /wp-content/plugins/erinyani/default.php | 11 |
| #331 | /wp-content/themes/classwithtostring.php | 11 |
| #332 | /wp-signup.php | 10 |
| #333 | /about-us/wp-login.php | 10 |
| #334 | /wp-config.php | 10 |
| #335 | /wp-content/plugins | 10 |
| #336 | /wp-content/themes/modular/lib/scripts/timthumb/thumb.php | 10 |
| #337 | /wpx.php | 10 |
| #338 | /wp-content/plugins/pwnd/block-support.php | 10 |
| #339 | /wp-admin/network/plugins.php | 9 |
| #340 | /new/wp-admin/setup-config.php | 9 |
| #341 | /wp/wp-admin/setup-config.php | 9 |
| #342 | /staging/wp-admin/setup-config.php | 9 |
| #343 | /backup/wp-admin/setup-config.php | 9 |
| #344 | /root/wp-login.php | 9 |
| #345 | /.well-known/wp-signup.php | 9 |
| #346 | /wp-includes/style-engine | 9 |
| #347 | /wp-content/themes/neve | 9 |
| #348 | /wp-content/themes/oceanwp | 9 |
| #349 | /wp-content/plugins/elementor | 9 |
| #350 | /wp-json/wp/v2/posts | 9 |
| #351 | /wp-admin/includes/admin-ajax.php | 9 |
| #352 | /wp-content/plugins/ioxi/ioxi/dropdown.php | 9 |
| #353 | /wp-content/uploads/2025/09/Resultados-Jan.-a-Julho-2025.pdf | 8 |
| #354 | /wp-files.php | 8 |
| #355 | /design/wp-content/thumb/timthumb.php | 8 |
| #356 | /wp-content/worksec.php | 8 |
| #357 | /wp-content/plugins/litespeed-cache/guest.vary.php | 8 |
| #358 | /wp-atom.php | 7 |
| #359 | /wp-admin/meta | 7 |
| #360 | /wp-content.php | 7 |
| #361 | /wp-admin/maint/fie.php | 7 |
| #362 | /wp-json/wc/v2/products | 6 |
| #363 | /wp-admin/network/index.php | 6 |
| #364 | /wp-content/languages/index.php | 6 |
| #365 | /wp-content/mu-plugins | 6 |
Data was last updated on: Oct 27, 2025
We love logs. In this section we will share some of the data we are parsing from our logs and honeypots we have live.
Logging for fun and a good night of sleep.
Latest log-based threat analysis added.
Do you have an idea for a research that is not here? See something wrong? Contact us at support@noc.org
14 days free trial. No credit card required.