WordPress - Last scanned URLs
Sep 17, 2025
Automatically updated daily

Checking for 404 errors in your logs can reveal more than just broken links, it can also expose files and URLs that attackers are actively scanning for. To track this behavior, we set up hundreds of honeypots and analyzed live web traffic data, giving us insight into which files and URLs are being targeted across the internet.


The table bellow list the top URLs being scanned on WordPress sites in the past 72 hours. This list of updated daily and shows the top plugins, backdoors and files that attacker are lookin for specifically to WordPress.


Rank Scanned URL Counter
#1 /wp-login.php30,016
#2 /wp-json/oembed/1.0/embed7,504
#3 /wp-cron.php3,064
#4 /wordpress1,755
#5 /wp1,591
#6 /wp-admin1,402
#7 /wp-content/plugins/fix/up.php1,400
#8 /wp-includes/wlwmanifest.xml1,239
#9 /wp-content/plugins/hellopress/wp_filemanager.php1,105
#10 /wp.php1,090
#11 /web/wp-includes/wlwmanifest.xml1,041
#12 /wordpress/wp-includes/wlwmanifest.xml1,032
#13 /wp-admin/images/moon.php1,030
#14 /wp/wp-includes/wlwmanifest.xml1,023
#15 /wp-content/plugins/wpterm.php990
#16 /2019/wp-includes/wlwmanifest.xml984
#17 /wp-content/style.php981
#18 /blog/wp-includes/wlwmanifest.xml977
#19 /shop/wp-includes/wlwmanifest.xml974
#20 /website/wp-includes/wlwmanifest.xml974
#21 /news/wp-includes/wlwmanifest.xml961
#22 /wp-admin/setup-config.php881
#23 /wp-admin/css815
#24 /wp-setup.php780
#25 /wp-content/wp-conflg.php769
#26 /wp-api.php769
#27 /wp-sitemap.xml756
#28 /wp-admin/style.php755
#29 /wp-includes/fonts/admin.php718
#30 /wp-includes/IXR/autoload_classmap.php711
#31 /wp-plain.php701
#32 /wp-content/index.php666
#33 /wp-admin/js/index.php626
#34 /wp-admin/css/colors/blue/index.php581
#35 /2018/wp-includes/wlwmanifest.xml577
#36 /wp-content/themes/style.php563
#37 /wp-includes/fonts/index.php532
#38 /wp-editor.php457
#39 /2020/wp-includes/wlwmanifest.xml433
#40 /wp-content/themes/seotheme/db.php392
#41 /wordpress/wp-admin/setup-config.php362
#42 /wp-admin/js350
#43 /wp1/wp-includes/wlwmanifest.xml340
#44 /wp-update.php317
#45 /wp-content/plugins/woocommerce/assets/fonts/WooCommerce.eot294
#46 /wp-control.php273
#47 /wp-content262
#48 /wp-admin/autoload_classmap.php261
#49 /wp-json/wp261
#50 /wp-json/oembed258
#51 /wp-content/themes/about.php257
#52 /wp-config251
#53 /wp-config.php.bak246
#54 /wp-admin/edit-tags.php239
#55 /test/wp-includes/wlwmanifest.xml232
#56 /wp-admin/css/colors/blue/atomlib.php229
#57 /wp-freya.php226
#58 /wp-admin/maint223
#59 /wp-admin/function.php223
#60 /wp-admin/css/colors/blue222
#61 /site/wp-includes/wlwmanifest.xml214
#62 /cms/wp-includes/wlwmanifest.xml212
#63 /wp-trackback.php205
#64 /wp-admin/admin-ajax.php204
#65 /wp-admin/includes/about.php198
#66 /wp-admin/css/colors/ectoplasm189
#67 /appWP/lab/wp-admin/css/colors/blue/blue.php189
#68 /wp-content/autoload_classmap.php187
#69 /wp-json/litespeed/v1/cdn_status186
#70 /wp-admin/maint/akcc.php185
#71 /wp-admin/install.php185
#72 /wp2/wp-includes/wlwmanifest.xml180
#73 /wp-json/wp-block-editor175
#74 /wp-json/elementor-pro175
#75 /wp-json/elementor-ai174
#76 /wp-json/wp/v2/users173
#77 /wp-json/elementor173
#78 /wp-json/hub-connector172
#79 /wp-json/forminator171
#80 /wp-json/wpmudev_pcs170
#81 /wp-json/wp-site-health170
#82 /wp-json/rankmath169
#83 /wp-json/beautiful-and-responsive-cookie-consent168
#84 /wp-json/wpraddons168
#85 /wp-json/wordfence168
#86 /wp-json/litespeed168
#87 /wp-admin/js/autoload_classmap.php167
#88 /sito/wp-includes/wlwmanifest.xml165
#89 /wp-admin/js/wp-login.php159
#90 /wp-content/plugins/wp-conflg.php159
#91 /wp-content/plugins/apikey/apikey.php158
#92 /wp-includes/style-engine/about.php154
#93 /wp-aa.php151
#94 /wp-json/sure-triggers/v1/automation/action150
#95 /wp-content/mu-plugins-old148
#96 /wp-signup.php146
#97 /wp-143
#98 /wp-includes/style.php141
#99 /wp-content/plugins/apikey/apikey.php.suspected140
#100 /wp-gr.php137
#101 /wp-includes/Requests/Response135
#102 /wp-includes/Requests/Cookie128
#103 /wp-includes/css126
#104 /wp-content/themes/admin.php125
#105 /wp-admin/meta122
#106 /wp-file.php121
#107 /wp-content/admin.php121
#108 /wp-includes/js/jcrop/Jcrop.php121
#109 /wp-content/uploads119
#110 /wp-config.php.un~118
#111 /wp-content/plugins/index.php118
#112 /wp-admin.php118
#113 /wp-includes117
#114 /wp-sitemap-users-1.xml117
#115 /wp-config.php.c116
#116 /wp-content/uploads/de_fb_uploads/b.php116
#117 /wp-includes/assets113
#118 /wp-includes/fonts/about.php113
#119 /wp-admin/images113
#120 /wp-config.php_old2011112
#121 /wp-includes/assets/autoload_classmap.php112
#122 /wp-includes/sitemaps/autoload_classmap.php111
#123 /wp-admin/js/widgets111
#124 /wp-content/plugins/ninja-forms111
#125 /wp-content/plugins/newsletters-lite/newsletters-lite-ajax.php111
#126 /wp-admin/includes111
#127 /wp-content/themes/themes.php110
#128 /wp-includes/ID3110
#129 /wp-includes/IXR/admin.php110
#130 /wp-includes/pomo/wp-conflg.php109
#131 /wp-includes/PHPMailer108
#132 /wp-content/themes108
#133 /wp-content/plugins/WordPressCore/cong.php108
#134 /wp-includes/sitemaps107
#135 /wp-includes/SimplePie/autoload_classmap.php107
#136 /wp-includes/html-api106
#137 /wp-includes/Text/autoload_classmap.php106
#138 /wp-includes/css/dist/widgets/about.php106
#139 /wp-includes/404.php105
#140 /wp-admin/css/colors/midnight105
#141 /wp-includes/sitemaps/providers103
#142 /wp-includes/Text/Diff103
#143 /wp-admin/css/colors103
#144 /wp-content/plugins/simple/simple.php103
#145 /wp-includes/IXR102
#146 /wp-includes/images101
#147 /wp-includes/rest-api100
#148 /wp-includes/certificates100
#149 /wp-includes/SimplePie99
#150 /wp-admin/maint/index.php98
#151 /wp-includes/customize98
#152 /wp-includes/Text/Diff/Renderer98
#153 /wp-includes/images/smilies97
#154 /wp-old96
#155 /wp-content/plugins/suffer/sec_upload.php94
#156 /wp-includes/sodium_compat94
#157 /wp-includes/rest-api/search94
#158 /wp-includes/block-bindings94
#159 /wp-includes/sodium_compat/src93
#160 /wp-conflg.php93
#161 /wp-activate.php93
#162 /wp-content/.env92
#163 /wp-includes/style-engine92
#164 /wp-content/upgrade/index.php92
#165 /wp-content/plugins/pwnd/pwnd.php92
#166 /wp-includes/rest-api/fields90
#167 /wp-includes/rest-api/endpoints90
#168 /wp-admin/.env89
#169 /wp-content/themes/index.php88
#170 /wp-content/uploads/index.php87
#171 /wp-content/plugins/about.php87
#172 /wp-includes/bk/index.php85
#173 /wp-22.php85
#174 /features/wordpress-management-tools84
#175 /wp-content/themes/twentytwentytwo/index.php83
#176 /wp-includes/ID3/index.php83
#177 /wp-json/wp/v2/pages/-99982
#178 /wp-includes/assets/index.php81
#179 /wp-admin/js/about.php80
#180 /wp-admin/css/colors/ectoplasm/about.php80
#181 /wp-admin/classwithtostring.php80
#182 /media/wp-includes/wlwmanifest.xml79
#183 /wp-2019.php79
#184 /wp-includes/images/about.php79
#185 /wp-content/plugins/wp-automatic/inc/csv.php78
#186 /wp-includes/blocks/shortcode/index.php78
#187 /wp-content/plugins/pwnd-1/pwnd.php77
#188 /wp-content/themes/twentytwentytwo76
#189 /wp-admin/dropdown.php76
#190 /wp-content/themes/kadence75
#191 /wp-content/themes/divi75
#192 /wp-admin/css/colors/blue/about.php75
#193 /wp-content/plugins/better-wp-security74
#194 /wp-content/plugins/w3-total-cache74
#195 /wp-content/plugins/wp-super-cache74
#196 /wp-content/plugins/yoast74
#197 /wp-content/themes/ultra74
#198 /wp-content/themes/sydney74
#199 /wp-content/themes/blocksy74
#200 /wp-content/themes/newspaper74
#201 /wp-content/themes/jupiter74
#202 /wp-content/themes/salient74
#203 /wp-content/themes/hestia74
#204 /wp-content/themes/bridge74
#205 /wp-content/themes/the774
#206 /wp-content/themes/avada74
#207 /wp-content/themes/astra74
#208 /wp-admin/css/colors/light/wp-login.php74
#209 /wp-content/plugins/wp-optimize73
#210 /wp-content/themes/porto73
#211 /wp-content/themes/x73
#212 /wp-content/themes/enfold73
#213 /wp-content/themes/generatepress73
#214 /wp-content/themes/neve73
#215 /wp-content/themes/storefront73
#216 /wp-content/themes/betheme72
#217 /wp-content/themes/oceanwp72
#218 /wp-content/themes/flatsome72
#219 /not_found/wp-login.php72
#220 /wp-content/plugins/wp-smushit71
#221 /wp-content/plugins/woocommerce71
#222 /wp-content/plugins/duplicator70
#223 /wp-content/plugins/gravityforms70
#224 /wp-content/themes/pridmag/db.php70
#225 /wp-content/about.php70
#226 /wp-admin/admin.php70
#227 /en/wp-json/oembed/1.0/embed70
#228 /wp-content/plugins/sucuri-scanner69
#229 /wp-content/plugins/seo-by-rank-math68
#230 /wp-content/plugins/wp-file-manager67
#231 /wp-comments-post.php66
#232 /wpls.php66
#233 /wp-content/plugins/wordfence65
#234 /wp-content/plugins/jetpack65
#235 /wp-content/plugins/wpforms-lite65
#236 /wp-content/uploads/2025/02/WFHResearch_updates_%20February2025.pdf65
#237 /wp-cliner.php65
#238 /wp-xm.php65
#239 /wp-xx.php65
#240 /wp-content/plugins/wp-rocket64
#241 /wp-content/plugins/all-in-one-seo-pack63
#242 /wp-admin/images/about.php63
#243 /wp-content/plugins/contact-form-763
#244 /wp-content/plugins/advanced-custom-fields62
#245 /wp-admin/maint/fie.php59
#246 /wp-content/uploads/2020/06/Mercado-de-59
#247 /wp-admin/images/xmrlpc.php58
#248 /wp-admin/network/xmrlpc.php58
#249 /es/wp-json/oembed/1.0/embed58
#250 /wp-content/worksec.php57
#251 /wp-content/themes/seotheme/mar.php57
#252 /wp-admin/user/xmrlpc.php57
#253 /wp-content/plugins/js_composer56
#254 /wp-admin/css/about.php56
#255 /old-wp-config.php55
#256 /wp-content/plugins/updraftplus55
#257 /wp-content/plugins/revslider55
#258 /wp-content/plugins/redirection55
#259 /wp-content/plugins/classic-editor55
#260 /wp-content/plugins/akismet54
#261 /wp-content/plugins/linkpreview/db.php54
#262 /wp-admin/network/cloud.php54
#263 /wp-json/wp/v2/posts53
#264 /wp-sigunq.php53
#265 /wp-content/plugins/admin.php53
#266 /wp-content/plugins52
#267 /wp-content/plugins/seoplugins/db.php52
#268 /wp-content/themes/hello-elementor51
#269 /wp-content/plugins/all-in-one-wp-migration51
#270 /wp-includes/rest-api/about.php51
#271 /wp-includes/Requests/about.php51
#272 /wp-load.php51
#273 /wp-includes/SimplePie/about.php50
#274 /wp-json49
#275 /blog/wp-login.php49
#276 /wp-admin/css/index.php49
#277 /wp-includes/ID3/about.php49
#278 /wp-content/plugins/seoplugins/mar.php49
#279 /wp-includes/Text/about.php49
#280 /2021/wp-includes/wlwmanifest.xml48
#281 /wp-content/plugins/really-simple-ssl48
#282 /wp-includes/fonts48
#283 /wp-includes/pomo/about.php48
#284 /wp-admin/images/index.php48
#285 /wp-includes/about.php48
#286 /wp-content/themes/aahana/json.php48
#287 /wp-content/themes/twentytwentythree47
#288 /wp-json/buddyboss-app/v1/signup/form47
#289 /wp-content/themes/kadence/functions.php47
#290 /wp-includes/Requests/Text/admin.php46
#291 /wp-content/plugins/Cache/Cache.php46
#292 /wp-includes/block-patterns/about.php46
#293 /wp-includes/widgets/about.php46
#294 /wp-login46
#295 /wp-content/upgrade-temp-backup/about.php46
#296 /wp-admin/js/widgets/cloud.php46
#297 /wp-content/languages/about.php46
#298 /wp-content/plugins/wp-theme-editor/include.php46
#299 /wp-includes/images/wlw45
#300 /wp-content/themes/twentytwentyfour45
#301 /wp-admin/admin-post.php45
#302 /wp-content/gallery/about.php45
#303 /wp-includes/IXR/about.php45
#304 /wp-content/themes/oceanwp/functions.php45
#305 /wp-xrm.php44
#306 /wp/pomo/pomo.php44
#307 /wp-content/content.php44
#308 /wp-admin/maint/maint/ajax-actions.php44
#309 /wp-admin/ajax-actions.php44
#310 /wp-content/themes/twentythirteen/functions.php44
#311 /wp-content/plugins/elementor43
#312 /wp-content/db-cache.php43
#313 /wp-content/themes/twentyeleven/functions.php43
#314 /wp-includes/blocks/about.php43
#315 /wp-includes/Text/Diff/Renderer/about.php42
#316 /wp-content/plugins/awesome-coming-soon/come.php42
#317 /wp-content/plugins/not/includes/about.php42
#318 /wp-index.php41
#319 /wp-content/themes/twentytwenty/functions.php41
#320 /wp-admin/css/colors/xmrlpc.php40
#321 /wp-admin/js/widgets/about.php740
#322 /wp-content/uploads/wp-conflg.php39
#323 /wp-includes/Text/Diff/alfa-rex.php39
#324 /wp-includes/css/wp-conflg.php39
#325 /wp-includes/pomo/pomo.php39
#326 /wp-admin/css/colors/blue/1.php39
#327 /wp-blog-header.php39
#328 /wp-admin/css/colors/coffee/cloud.php39
#329 /wp-admin/class-db.php38
#330 /wp-admin/xmrlpc.php38
#331 /wp-admin/css/colors/blue/xmrlpc.php38
#332 /wp-admin/js/widgets/xmrlpc.php38
#333 /wp-admin/css/colors/coffee/xmrlpc.php38
#334 /wp-admin/repeater.php38
#335 /wp-admin/cloud.php38
#336 /wp-admin/css/colors/blue/cloud.php38
#337 /wp-admin/css/colors/cloud.php38
#338 /wp-admin/images/cloud.php38
#339 /wp-admin/user/cloud.php38
#340 /wp-content/themes/classic/inc37
#341 /wp-content/upgrade37
#342 /wp-includes/Text/Diff/Engine/about.php37
#343 /wp-admin/css/colors/light36
#344 /wp-content/plugins/litespeed-cache36
#345 /wp-content/plugins/google-seo-rank/module.php36
#346 /wp-content/plugins/seoo/wsoyanz1.php36
#347 /wp-contentt.php36
#348 /wp-content/blogs.dir/about.php36
#349 /wordpress/wp-config.php.735
#350 /wp-content/mu-plugins35
#351 /wp-includes/ID3/file.php35
#352 /wp-admin/includes/xmrlpc.php35
#353 /wp-consar.php35
#354 /wp-content/plugins/seoo/wsoyanz.php35
#355 /wp-content/repeater.php35
#356 /wp-p.php735
#357 /wp-admin/includes/cloud.php35
#358 /wp-content/updates.php35
#359 /wp-content/updraft/about.php35
#360 /wp-includes.bak/html-api/about.php35
#361 /wp-includes/customize/about.php35
#362 /shop/wp-login.php34
#363 /wp-confiq.php34
#364 /wp-admin/includes/class_api.php34
#365 /wp-configs.php34
#366 /wp-content/uploads/BbUMY/flower.php34
#367 /wp-includes/repeater.php34
#368 /wp-includes/random_compat32
#369 /wp-includes/bk31
#370 /wp-l0gin.php31
#371 /wp-includes/theme-compat29
#372 /wp-mail.php29
#373 /wp-content/plugins/include.php29
#374 /wordpress.zip29
#375 /wp/wp-login.php28
#376 /wp-config.php.backup28
#377 /wp-includes/css/index.php28
#378 /wp-admin/css/colors/index.php28
#379 /wp-includes/certificates/plugins.php28
#380 /wp-content/themes/travel/issue.php27
#381 /wp-json/wc/store/v2/products27
#382 /wp-config.php27
#383 /loja/wp-login.php27
#384 /blog/wordpress/website-is-down-not-working-not-loading-fixes27
#385 /revendedor/wp-login.php27
#386 /wp-content/themes/twentytwentyone/functions-info.php27
#387 /wp-includes/Text/Diff/Engine/index.php27
#388 /wp-content/uploads/202226
#389 /wp-content/plugins/WordPressCore/include.php26
#390 /wp/index.php26
#391 /job/wp-login.php25
#392 /wp-content/uploads/202125
#393 /old/wp-admin/setup-config.php25
#394 /new/wp-admin/setup-config.php25
#395 /wp/wp-admin/setup-config.php25
#396 /wp-su.php25
#397 /wp-includes/buy.php25
#398 /modules/mod_simplefileuploadv1.3/elements/wpxadmin.php25
#399 /wp-admin/post-new.php24
#400 /wp-includes/images/crystal24
#401 /wp-json/wc/store/v3/products24
#402 /wp-admin/maint/about.php724
#403 /wp-includes/blocks23
#404 /wp-includes/Requests/Auth23
#405 /wp-includes/Requests/Utility23
#406 /wp-includes/Requests/Transport23
#407 /wp-includes/Requests/Proxy23
#408 /wp-includes/SimplePie/Content/Type23
#409 /wp-includes/SimplePie/Cache23
#410 /wp-admin/network23
#411 /wp-admin/memberfuns.php23
#412 /wp-admin/userfuns.php23
#413 /wp-json/reallysimplessl/v1/two_fa/skip_onboarding23
#414 /wp-includes/Text/Diff/Engine/Engine22
#415 /wp-includes/block-supports22
#416 /wp-includes/widgets22
#417 /wp-admin/user22
#418 /wp-includes/Requests/Exception22
#419 /wp-includes/Requests/Exception/HTTP22
#420 /wp-content/themes/modular/lib/scripts/timthumb/thumb.php22
#421 /wp-tiroto.php22
#422 /wp-content/plugins/build21
#423 /wp-includes/block-patterns21
#424 /wp-includes/Text21
#425 /wp-includes/Requests21
#426 /wp-includes/pomo21
#427 /wp-includes/js21
#428 /wp-admin/undefinedjetpack/v4/site/benefits21
#429 /wp-content/themes/twentyfive/include.php21
#430 /wp-includes/images/crystal/index.php21
#431 /wp-includes/php-compat20
#432 /wp-includes/images/media20
#433 /wp-includes/js/codemirror20
#434 /job/analista-de-atendimento-ao-cliente/wp-login.php20
#435 /wp-admin/undefinedjetpack/v4/connection/data20
#436 /wp-20240527.zip20
#437 /wp-includes/SimplePie/Content19
#438 /wp-content/themes/travelscape/json.php19
#439 /wp-content/wso.php19
#440 /wp-content/uploads/202319
#441 /wordpress-20240527.zip19
#442 /wordpress-full.zip19
#443 /wp-scripts.php19
#444 /wp-admin/index.php18
#445 /wp-mn.php18
#446 /wp-admin/network/network/cache.php18
#447 /staging/wp-admin/setup-config.php18
#448 /backup/wp-admin/setup-config.php18
#449 /wp-content/plugins/*18
#450 /wp-content/plugins/easy-table-of-contents/vendor/icomoon/fonts18
#451 /wp-content/litespeed/css/%23a18
#452 /wp-content/themes/bones/library/font18
#453 /wp-files.zip18
#454 /wordpress-files.zip18
#455 /wp-admin/profile.php17
#456 /wp-links.php17
#457 /wp-content/languages17
#458 /wp-content/plugins/init-help/init.php17
#459 /wp-content/plugins/jetpack/modules/carousel/images17
#460 /wp.zip17
#461 /wp-config.zip17
#462 /wp-backup.zip17
#463 /wp-includes/js/crop16
#464 /wp-includes/Text/Diff/Engine16
#465 /wp-content/uploads/202416
#466 /wp-content/plugins/ioxi/ioxi/dropdown.php16
#467 /wp-includes/images/include.php16
#468 /wordpress-2024.zip16
#469 /wordpress-complete.zip16
#470 /wp-full.zip16
#471 /loja/wp-admin/plugins.php15
#472 /wp-content/plugins/lwbdene/index.php15
#473 /wp-includes/widgets/include.php15
#474 /wordpress-site.zip15
#475 /wp-site.zip15
#476 /new/wp-admin/install.php14
#477 /wordpress/wp-admin/install.php14
#478 /wp/wp-admin/install.php14
#479 /old/wp-admin/install.php14
#480 /wp-content/themes/include.php14
#481 /wordpress-admin.zip14
#482 /wp-login.php:Lucas13
#483 /wp-includes/js/tinymce/skins/lightgray/img/index.php13
#484 /wp-head.php13
#485 /nv/wp13
#486 /wp-content/uploads/2018/01/yoga-e-massagem_fam13
#487 /wp-admin/maint/atomlib.php13
#488 /wp-admin.zip13
#489 /wp-2024.zip13
#490 /wp-pridmag/up.php12
#491 /wp-content/languages/index.php12
#492 /wp-content/uploads/2018/01/yoga-para-bebes-segunda-sess12
#493 /wp-admin/user/moon.php12
#494 /wp-content/plugins/wpyii2/wpyii2.php12
#495 /wp-admin/js/wp-conflg.php11
#496 /wp-json/post-smtp/v1/connect-app11
#497 /wp-admin/x.php11
#498 /wp-admin-login11
#499 /wp-apxupx.php11
#500 /wp-content/themes/bltm/wp-login.php11


Data was last updated on: Sep 17, 2025



Logging Research

We love logs. In this section we will share some of the data we are parsing from our logs and honeypots we have live.

Trunc Logging

Logging for fun and a good night of sleep.

  • Real time search
  • Google simple
  • Cheap
  • Just works
  • PCI compliance
Trunc Research

Latest log-based threat analysis added.

Contact us!

Do you have an idea for a research that is not here? See something wrong? Contact us at support@noc.org

Tired of price gouging
  • Clear pricing
  • No need to guess
  • Real people
  • Real logging

Simple, Affordable, Log Management and Analysis.

14 days free trial. No credit card required.